CVE-2026-72774
Received Received - Intake

Credential Authorization Bypass in n8n Workflow

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72774
EUVD
EUVD-2026-56100

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.67 (exc)
n8n n8n 2.31.5
n8n n8n 2.32.1
n8n n8n to 1.123.67|end_excluding=2.31.5|end_excluding=2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in n8n versions before 1.123.67, 2.31.5, and 2.32.1. An authenticated user with edit access to a shared workflow can reference another user's credential via an expression in the HTTP Request node. The permission check fails because it compares the unresolved expression instead of the resolved credential type, allowing unauthorized access to credentials.

Detection Guidance

To detect this vulnerability, audit n8n instances for unauthorized credential access in shared workflows. Check HTTP Request nodes for expressions referencing other users' credentials. Review logs for unusual credential usage or exfiltration attempts. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows an attacker to access or exfiltrate credentials they are not authorized to use, provided they know the target credential's identifier. It can lead to unauthorized data access, credential theft, or further attacks using the compromised credentials.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with privacy regulations, and potential legal or financial penalties due to compromised credentials.

Mitigation Strategies

Upgrade n8n to versions 1.123.67, 2.31.5, or 2.32.1 or later. Restrict instance access to trusted users only. Temporarily exclude the HTTP Request node if possible. Audit credential sharing and workflow access permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart