CVE-2026-59207: n8n AI Agents Credential Access Control Bypass

Technical summary

The vulnerability stems from insufficient input validation and access control enforcement in the AI Agents subsystem. When an MCP tool is configured within an AI Agent workflow, n8n does not properly apply the 'Allowed HTTP Request Domains' restriction that would normally be enforced at the credential level. This allows a user to bypass domain whitelisting and direct requests—including credential secrets—to arbitrary external URLs. The issue is classified under CWE-693 (Protection Mechanism Failure) and carries a CVSS 3.1 score of 6.5 (MEDIUM severity). The attack vector is network-based, requires low complexity, and demands prior authentication (PR:L), but does not require user interaction and results in high confidentiality impact (C:H).

Business impact

Organizations using n8n for workflow automation face credential compromise risk from insider threats. Any team member with use-only access to shared credentials—a common pattern in multi-user automation environments—could secretly exfiltrate secrets. This is particularly dangerous for credentials with elevated privileges (API keys, database passwords, service account tokens). Compromised credentials enable lateral movement, unauthorized data access, and potential disruption of downstream systems that rely on those credentials. The impact is heightened in environments where credentials are shared across multiple workflows and users.

Affected systems

n8n versions before 2.27.4 (1.x/2.x release line) and before 2.28.1 (2.28.x release line) are vulnerable. Both open-source and self-hosted n8n instances are affected. Cloud-hosted n8n instances managed by the vendor should be verified against vendor communications regarding patch deployment status. The vulnerability specifically affects deployments that use the AI Agents feature in combination with MCP tools and shared credentials with domain restrictions configured.

Exploitability

Exploitability is moderate. An attacker must already possess member-level access to the n8n instance and have use-only access to at least one credential with a configured domain restriction. The attack is straightforward: create or modify an AI Agent workflow with an MCP tool, point it to an attacker-controlled server, and execute the workflow to capture the credential secret. No special tools or complex techniques are required. However, the requirement for pre-existing access limits the scope of potential attackers to insiders or accounts compromised through other means. This vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade n8n to version 2.27.4 or later (if on the 2.27.x line) or version 2.28.1 or later (if on the 2.28.x line). Verify the specific version through your package manager or admin console before applying patches. Organizations should prioritize patching instances that maintain shared credentials with domain restrictions. As an interim measure, restrict which users can access the AI Agents feature and audit existing AI Agent workflows for suspicious MCP tool configurations or external URL targets. Implement credential rotation for any secrets managed by n8n, particularly those with elevated privileges, to mitigate impact of potential compromise during the patch window.

Patch guidance

Apply the latest available n8n update from your deployment method: for npm/Node.js installations, run `npm install -g n8n@latest` or update via your package manager; for Docker deployments, pull the latest image tag; for self-hosted Kubernetes, update the Helm chart or manifest to reference version 2.27.4 or 2.28.1 or later. Verify the patch in a non-production environment first to ensure workflow continuity. After patching, confirm that domain restrictions on credentials are enforced by testing an MCP tool with a blocked domain—it should fail to connect. Consult the official n8n release notes for any breaking changes or configuration updates in your target version.

Detection guidance

Review AI Agent workflows for MCP tools configured with external or suspicious URLs that differ from documented business use cases. Audit credential access logs to identify which users have accessed shared credentials and when. Monitor outbound network traffic from n8n instances to detect connections to unexpected external servers, particularly during AI Agent workflow execution. Check n8n logs for successful executions of AI Agent workflows that use MCP tools; correlate timestamps with credential access. If available, enable detailed request logging to capture the destination URLs and payloads of MCP tool calls. Investigate any workflows created or modified by lower-privilege users that reference credentials with domain restrictions.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM CVSS score because it enables authenticated credential theft—a high-impact outcome in automation-heavy environments. The fix is straightforward and low-risk. Organizations with shared credentials and multi-user n8n instances should patch immediately to prevent insider threats from exfiltrating secrets. The low complexity of exploitation and the prevalence of workflow automation in modern enterprises elevate practical risk above the numeric score.

Risk score, explained

CVSS 3.1 score of 6.5 reflects the following factors: Network-accessible attack surface (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), and no user interaction needed (UI:N) are balanced against confidentiality impact (C:H) being the sole harmful outcome—no integrity or availability loss. The score appropriately penalizes the requirement for prior access but acknowledges the severity of credential exposure. In practice, organizations with strict credential governance and limited user access to shared secrets may face lower real-world risk than the score suggests; those with permissive shared credential models face higher risk.

Frequently asked questions