CVE-2026-65596: n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth…

PriorityP350high8.1CVSS 3.1

AVNACLPRLUINSUCHIHAN

EPSS

0.21%

11.3th percentile

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
n8n-io	n8n	< 1.123.64	1.123.64
n8n-io	n8n	< 2.30.1	2.30.1
n8n-io	n8n	< 2.29.8	2.29.8
n8n	n8n	< 1.123.64	1.123.64
n8n	n8n	—	—
n8n	n8n	>= 0 < 1.123.64	1.123.64
n8n	n8n	>= 2.0.0 < 2.29.8	2.29.8
n8n	n8n	>= 2.0.0 < 2.29.8	2.29.8
n8n	n8n	>= 2.30.0 < 2.30.1	2.30.1

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.