CVE-2026-25631: n8n Auth Bypass Vulnerability

CVE-2026-25631 Overview

CVE-2026-25631 is an Input Validation Error vulnerability discovered in n8n, an open source workflow automation platform. Prior to version 1.121.0, a flaw in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration.

This vulnerability specifically affects users who have credentials configured with wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. The improper validation of these wildcard patterns could allow attackers to craft requests that bypass the intended domain restrictions.

Critical Impact

Authenticated attackers can bypass credential domain validation to exfiltrate sensitive credentials to attacker-controlled domains when wildcard patterns are used in allowed domain configurations.

Affected Products

• n8n workflow automation platform versions prior to 1.121.0
• Installations using wildcard domain patterns in credential "Allowed domains" settings

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25631 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25631

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the HTTP Request node's credential domain validation mechanism. When users configure credentials with wildcard domain patterns to restrict which domains can receive those credentials, the validation logic fails to properly enforce these restrictions.

The flaw allows authenticated attackers to craft HTTP requests that bypass the wildcard domain matching, enabling credentials to be sent to domains outside the intended allowed list. This is particularly dangerous in workflow automation environments where credentials for various services may be stored and used across multiple integrations.

The network-accessible nature of this vulnerability means that any authenticated user with access to create or modify workflows could potentially exploit this issue to exfiltrate credentials to external domains under their control.

Root Cause

The root cause is improper input validation in the domain matching logic for wildcard patterns. The validation function does not correctly parse and match wildcard domain specifications (e.g., *.example.com), allowing attackers to construct domain names that evade the intended restrictions while still receiving the associated credentials.

Attack Vector

An authenticated attacker exploits this vulnerability by:

1. Identifying workflows or credentials that use wildcard domain patterns in allowed domain configurations
2. Creating or modifying an HTTP Request node to target a domain that should not match the wildcard pattern but incorrectly passes validation
3. Triggering the workflow execution, causing credentials to be sent to the attacker-controlled domain
4. Capturing the exfiltrated credentials on the receiving domain

The vulnerability manifests in the credential domain validation function within the HTTP Request node. The improper wildcard pattern matching allows domains like attacker.example.com.malicious.com to potentially bypass validation intended for *.example.com. For detailed technical analysis, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25631

Indicators of Compromise

• Unusual HTTP requests from n8n workflows to unexpected or suspicious domains
• Credential usage logs showing requests to domains outside expected wildcard patterns
• Workflow modifications by users adding HTTP Request nodes targeting unusual domains
• Network traffic from n8n instances to newly registered or suspicious external domains

Detection Strategies

• Monitor n8n workflow execution logs for HTTP Request nodes sending credentials to unexpected domains
• Implement network-level monitoring to detect outbound connections from n8n to unauthorized destinations
• Review workflow audit logs for suspicious modifications to HTTP Request nodes or credential configurations
• Deploy endpoint detection to alert on anomalous credential usage patterns

Monitoring Recommendations

• Enable detailed logging for all HTTP Request node executions including target domains
• Configure alerts for credentials being used against domains not explicitly whitelisted
• Regularly audit workflow configurations for proper credential domain restrictions
• Implement network segmentation to limit n8n's ability to connect to arbitrary external domains

How to Mitigate CVE-2026-25631

Immediate Actions Required

• Upgrade n8n to version 1.121.0 or later immediately
• Review all credentials using wildcard domain patterns in "Allowed domains" settings
• Consider replacing wildcard patterns with explicit domain lists until upgrade is complete
• Audit recent workflow executions for suspicious HTTP Request node activity

Patch Information

This vulnerability is fixed in n8n version 1.121.0 and later. Users should update their n8n installations to the latest available version. The fix addresses the improper domain validation logic in the HTTP Request node to correctly enforce wildcard pattern restrictions.

For official patch details, refer to the GitHub Security Advisory.

Workarounds

• Replace wildcard domain patterns with explicit, fully-qualified domain lists in credential configurations
• Implement network-level controls to restrict n8n outbound connections to known-good destinations only
• Temporarily disable or restrict access to workflows using affected credentials until upgrade is applied
• Use network proxies or firewalls to enforce domain allowlists at the infrastructure level

# Configuration example - Replace wildcard patterns with explicit domains
# Before (vulnerable): *.example.com
# After (secure): api.example.com, auth.example.com, data.example.com

# Network-level mitigation example using iptables
# Restrict n8n outbound HTTP/HTTPS to specific IP ranges
iptables -A OUTPUT -p tcp --dport 443 -d trusted.example.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner n8n -j DROP