Vulnerability Description
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| N8N | N8N | < 1.123.64 |
Related Weaknesses (CWE)
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jmMitigationVendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-grapThird Party Advisory
FAQ
What is CVE-2026-65596?
CVE-2026-65596 is a vulnerability with a CVSS score of 8.1 (HIGH). n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unli...
How severe is CVE-2026-65596?
CVE-2026-65596 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65596?
Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.