AI Agent MCP Tool HTTP Request Domain Bypass in n8n

Compliance Impact

This vulnerability allows a member-level user to bypass domain restrictions on shared credentials and send secret information to an external server they control. This poses a significant risk to the confidentiality of sensitive data.

Such unauthorized disclosure of sensitive information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access and transmission of personal and protected health information.

Organizations using affected versions of n8n with the AI Agents feature enabled and shared credentials with domain restrictions may face increased risk of data breaches, potentially resulting in regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-59207 is a vulnerability in the n8n workflow automation platform affecting versions prior to 2.27.4 and 2.28.1. It involves the AI Agents feature bypassing the configured Allowed HTTP Request Domains restriction on credentials. This means that a member-level user with use-only access to a shared credential could exploit this flaw by pointing an MCP tool at an arbitrary URL, allowing them to send the credential's secret to an external server they control.

The vulnerability only affects instances where the AI Agents module is enabled and at least one credential with domain restrictions is shared with a member-level user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability poses a significant risk to the confidentiality of your credentials because an unauthorized member-level user could exfiltrate secret information to an external server. While it does not fully impact system availability, it also presents a minor risk to data integrity.

• Unauthorized disclosure of credential secrets to external servers.
• Potential compromise of workflows that rely on those credentials.
• Risk is limited to environments where AI Agents are enabled and credentials with domain restrictions are shared with member-level users.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the AI Agents module is enabled in your n8n instance and if any member-level users with use-only access have shared credentials with domain restrictions. Monitoring network traffic for unusual outbound requests to external servers from the AI Agents feature could indicate exploitation attempts.

Since the vulnerability allows sending credential secrets to arbitrary external URLs, you can inspect logs or use network monitoring tools to detect unexpected HTTP requests originating from n8n to unknown or unauthorized domains.

Specific commands are not provided in the resources, but general approaches include:

• Check environment variables to see if AI Agents module is enabled: `echo $N8N_ENABLED_MODULES`
• Review n8n logs for suspicious HTTP requests or errors related to AI Agents.
• Use network monitoring tools like `tcpdump` or `wireshark` to capture outbound HTTP traffic from the n8n server and filter for unusual destinations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading n8n to version 2.28.1 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, temporary mitigations include:

• Disable the AI Agents module by removing it from the N8N_ENABLED_MODULES environment variable.
• Restrict credential sharing to only trusted users to prevent misuse by member-level users.
• Audit all shared credentials that have domain restrictions to ensure they are not exposed or misused.

Useful 0 Not Useful 0