CVE-2026-72774
n8n before 1.123.67 Authentication Bypass via HTTP Request Node
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.
| CWE | CWE-639 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new unknown vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n8n-io / n8n
0 < 1.123.67
n8n-io / n8n
0 < 2.32.1
n8n-io / n8n
0 < 2.31.5
References
Credits
🔍 g4nkd