CVE-2026-72771: n8n Information Disclosure Vulnerability

CVE-2026-72771 Overview

CVE-2026-72771 is an authorization flaw in n8n workflow automation platform versions before 2.32.1. The vulnerability allows low-privileged workflow editors to bypass the Allowed HTTP Request Domains allowlist through multiple AI and LLM nodes. Attackers with use-only access to shared credentials can redirect API requests to attacker-controlled hosts by supplying malicious base or endpoint URLs. This enables exfiltration of credential secrets that can then be reused against underlying services such as OpenAI, Anthropic, or other integrated LLM providers. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
Low-privileged workflow editors can exfiltrate high-value AI/LLM API credentials from shared n8n instances, enabling downstream account takeover of third-party services.

Affected Products

n8n workflow automation platform versions prior to 2.32.1
AI and LLM node integrations within affected n8n releases
Shared credential stores accessed by workflow editors with use-only permissions

Discovery Timeline

2026-08-11 - CVE-2026-72771 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72771

Vulnerability Analysis

n8n enforces an Allowed HTTP Request Domains allowlist to restrict outbound requests made through shared credentials. This control prevents workflow editors from redirecting authenticated requests to arbitrary destinations. In versions before 2.32.1, multiple AI and LLM nodes fail to consult this allowlist when processing user-supplied base or endpoint URL parameters.

A workflow editor holding only use-only access to a shared credential can configure an AI node with a custom endpoint URL pointing to an attacker-controlled server. When the workflow executes, n8n attaches the shared credential secret to the outbound request. The attacker receives the API key or bearer token in the request headers and can reuse it against the legitimate service.

Root Cause

The root cause is inconsistent enforcement of authorization policy across node types. The Allowed HTTP Request Domains check exists for generic HTTP Request nodes but was not applied to AI and LLM node families that accept overridable base URLs. This inconsistency violates the principle of complete mediation on privileged credential material.

Attack Vector

Exploitation requires an authenticated user with workflow editor privileges and use-only access to a shared credential. The attacker creates or modifies a workflow that uses an affected AI node, sets the base URL parameter to a host they control, and executes the workflow. The credential secret is transmitted in the outbound request and captured server-side. No user interaction from an administrator is required. See the GitHub Security Advisory GHSA-64xh-79j6-r5v8 and the VulnCheck Advisory on n8n for additional technical detail.

Detection Methods for CVE-2026-72771

Indicators of Compromise

Outbound HTTPS requests from n8n hosts to domains not present in the configured Allowed HTTP Request Domains allowlist.
AI or LLM node configurations referencing non-standard base URLs or endpoint parameters that do not match documented provider hostnames.
Unexpected authentication failures or usage spikes against legitimate LLM provider accounts, indicating credential reuse from an unknown source IP.

Detection Strategies

Audit workflow definitions in the n8n database for AI/LLM node parameters containing custom baseURL, endpoint, or host fields.
Correlate n8n workflow execution logs with egress firewall or proxy logs to identify requests to previously unseen destinations.
Review credential access audit trails for use-only credential consumption by workflow editors who did not previously interact with LLM integrations.

Monitoring Recommendations

Enable egress filtering on n8n worker nodes and alert on any DNS resolution or HTTPS connection outside an approved LLM provider list.
Monitor n8n audit logs for workflow modifications that add or change AI node URL parameters.
Track third-party LLM provider usage dashboards for anomalous request origins or rate spikes indicating stolen key reuse.

How to Mitigate CVE-2026-72771

Immediate Actions Required

Upgrade n8n to version 2.32.1 or later on all self-hosted and managed deployments.
Rotate every shared credential stored in n8n that was accessible to workflow editors, including OpenAI, Anthropic, and other LLM provider API keys.
Review recent workflow executions for outbound requests to unexpected hosts and revoke any credentials suspected of exposure.

Patch Information

The fix is included in n8n version 2.32.1. The patch extends Allowed HTTP Request Domains enforcement to AI and LLM node families that accept user-supplied base or endpoint URLs. Refer to the GitHub Security Advisory GHSA-64xh-79j6-r5v8 for release notes and upgrade guidance.

Workarounds

Restrict workflow editor role assignments to trusted users until patching is complete.
Remove shared credentials for high-value AI/LLM providers and require per-user credentials that limit blast radius.
Enforce network egress restrictions at the host or container level to permit only known LLM provider endpoints.

bash

# Configuration example: upgrade n8n via npm and verify version
npm install -g n8n@2.32.1
n8n --version

# Configuration example: restrict allowed request domains (post-upgrade)
export N8N_ALLOWED_HTTP_REQUEST_DOMAINS="api.openai.com,api.anthropic.com"