CVE-2026-77076
Received Received - Intake

Information Disclosure in n8n Workflow Automation

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77076
EUVD
EUVD-2026-63265

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 2.33.4 (exc)
n8n n8n to 2.34.1 (exc)
n8n n8n to 1.123.69 (exc)
n8n n8n 2.33.4
n8n n8n 2.34.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77076 is an information disclosure vulnerability in n8n versions before 1.123.69, 2.33.4, and 2.34.1. When a GraphQL node's request fails at the connection level, it exposes decrypted credential secrets in the error message headers. These secrets are then stored in execution data, allowing authenticated users to retrieve them.

Detection Guidance

Check n8n execution logs for GraphQL node failures that expose decrypted credential headers. Look for raw HTTP client errors in stored execution data. Review access logs for unauthorized reads of execution records.

Impact Analysis

This vulnerability allows any authenticated user with access to execution records to retrieve decrypted credential secrets. This could lead to unauthorized access to systems, data breaches, or further exploitation of connected services using the exposed credentials.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A credential leak may violate these regulations, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade n8n to versions 1.123.69, 2.33.4, or 2.34.1 or later. Restrict access to execution data and disable the GraphQL node if not needed. Audit existing execution records for exposed credentials and revoke any compromised secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart