n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
n8n
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2026-65596
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting different apps and online services. This flaw affects versions before 1.123.64, 2.29.8 and 2.30.1. It only affects setups where a saved login has a limit on which web addresses it may be sent to, and people other than its owner can use that login. The GraphQL building block does not enforce that limit. A signed-in user who can create or edit workflows could point that block at a server they control and steal the protected login details. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- Update n8n to version
1.123.64,2.29.8or2.30.1, choosing the one that matches the version line you already use. - Check whether any saved login in your n8n has a limit on which web addresses it may be sent to and can be used by people other than its owner. If so, your setup is affected, so treat the update as urgent.
- Read the vendor advisory linked on this page for details about the fixed releases.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.