CVE-2026-77081

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.34.1

Description A bypass of the allowed-domains policy exists in the GraphQL node. When the Authentication parameter is configured in expression mode, all authentication-gated credential selectors are treated as active. If two credentials of different types are attached, the node only enforces the allowed-domains policy of the first credential while still attaching material from both. This allows an authenticated user with workflow-authoring rights to send a domain-restricted credential to an attacker-controlled endpoint, leading to the exfiltration of the credential.

Recommendations Update n8n to version 1.123.69 or later. Update n8n to version 2.34.1 or later.