CVE-2026-65596: n8n Auth Bypass Vulnerability

CVE-2026-65596 Overview

CVE-2026-65596 is an authorization flaw in n8n, an open-source workflow automation platform. The GraphQL node fails to enforce the Allowed HTTP Request Domains restriction on HTTP-based credentials, including Header Auth, Basic Auth, Query Auth, and OAuth. The HTTP Request node correctly enforces this restriction, but the GraphQL node does not. An authenticated user who can create or edit workflows can redirect the GraphQL endpoint to an attacker-controlled server and exfiltrate restricted credentials. The flaw is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated workflow editors can bypass domain restrictions in the GraphQL node to exfiltrate shared HTTP credentials to attacker-controlled endpoints.

Affected Products

n8n versions before 1.123.64
n8n versions before 2.29.8
n8n versions before 2.30.1

Discovery Timeline

2026-07-22 - CVE-2026-65596 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65596

Vulnerability Analysis

n8n allows administrators to restrict where HTTP credentials can be sent by configuring an Allowed HTTP Request Domains list on each credential. This control prevents users of a shared credential from directing authenticated requests to arbitrary destinations. The HTTP Request node honors this list. The GraphQL node does not.

An authenticated user with permission to create or edit workflows can add a GraphQL node, attach a restricted credential such as a Header Auth or OAuth token, and set the endpoint URL to a server they control. Because the domain check is missing, n8n sends the credential material to the attacker's server. The attacker then captures the token, API key, or Authorization header.

Only instances where a credential has Allowed HTTP Request Domains configured and is usable by non-owner users are affected.

Root Cause

The GraphQL node's request-dispatch logic omits the authorization check that validates the target URL against the credential's Allowed HTTP Request Domains list. The HTTP Request node performs this check before sending the credential. The inconsistent enforcement across nodes results in a broken access control condition classified as [CWE-863].

Attack Vector

The attack requires network access to the n8n instance and an authenticated account with workflow edit permissions. The attacker creates a workflow containing a GraphQL node, selects a shared credential subject to domain restrictions, and sets the endpoint URL to a domain they operate. Executing the workflow causes n8n to attach the credential to the outbound request. The attacker logs the incoming request and recovers the secret. Refer to the GitHub Security Advisory GHSA-gq66-9cw5-j5jm for the maintainer's technical description.

Detection Methods for CVE-2026-65596

Indicators of Compromise

Outbound HTTP or HTTPS requests from the n8n host to domains not present in any credential's Allowed HTTP Request Domains list.
Workflow definitions containing GraphQL nodes bound to shared credentials with endpoint URLs pointing to external or unusual hosts.
Audit log entries showing workflow creation or edits by non-owner users that add or modify GraphQL nodes referencing restricted credentials.

Detection Strategies

Review the n8n workflow database for n8n-nodes-base.graphql node entries and correlate their endpoint URLs against the allowlist configured on each linked credential.
Monitor egress traffic from n8n workers and match destination FQDNs against the union of allowed domains defined in credential metadata.
Alert on new or modified workflows created by accounts that are not the credential owner when those workflows reference restricted credentials.

Monitoring Recommendations

Enable n8n audit logging and forward events to a centralized logging platform for retention and query.
Track authentication failures and unexpected 4xx or 5xx responses from third-party APIs, which may indicate credentials sent to the wrong destination.
Baseline outbound destinations from the n8n host and alert on first-seen domains, especially those receiving Authorization, X-API-Key, or bearer token headers.

How to Mitigate CVE-2026-65596

Immediate Actions Required

Upgrade n8n to version 1.123.64, 2.29.8, 2.30.1, or later depending on your release branch.
Rotate all HTTP-based credentials that were shared with non-owner users and had Allowed HTTP Request Domains configured.
Audit existing workflows for GraphQL nodes referencing restricted credentials and validate their endpoint URLs.

Patch Information

The n8n maintainers fixed the issue in versions 1.123.64, 2.29.8, and 2.30.1. The patch extends the Allowed HTTP Request Domains enforcement to the GraphQL node so it matches the behavior of the HTTP Request node. See the GitHub Security Advisory GHSA-gq66-9cw5-j5jm and the VulnCheck Advisory on n8n Exfiltration for release details.

Workarounds

Restrict workflow creation and edit permissions to credential owners until the patched version is deployed.
Remove Allowed HTTP Request Domains credentials from sharing scopes so non-owner users cannot attach them to workflows.
Block egress from n8n hosts at the network layer to only the domains explicitly required by production workflows.

bash

# Verify installed n8n version and upgrade to a patched release
n8n --version
npm install -g n8n@1.123.64
# or, for the 2.29.x branch
npm install -g n8n@2.29.8
# or, for the 2.30.x branch
npm install -g n8n@2.30.1