CVE-2026-65596
Medium
Elevated severity or exploit probability.
CVSS base
8.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS — probability of exploitation (30 days)
0.2%
11.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-863
Published 2026-07-22 · modified 2026-07-27
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | L | Low |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-07-22 — Published (NVD)
- 2026-07-27 — Last modified (NVD)
Description
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.