{"data":{"id":"30afdf91-db59-4e10-8fcf-ad1404b8d858","title":"GHSA-gq66-9cw5-j5jm: n8n: GraphQL Node Bypasses \"Allowed HTTP Request Domains\" Restriction","summary":"The GraphQL node in n8n did not enforce the \"Allowed HTTP Request Domains\" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth and OAuth, unlike the HTTP Request node. An authenticated user who can create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where such a credential is usable by non-owner users are affected.","solution":"Fixed in n8n versions 1.123.64, 2.29.8 and 2.30.1; users should upgrade to one of these or later. If upgrading is not immediately possible, administrators should consider restricting workflow creation and editing permissions to fully trusted users only, restricting credential sharing to fully trusted users only, and auditing credentials with domain restrictions for unexpected sharing relationships. These workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-gq66-9cw5-j5jm","publishedAt":"2026-07-22T22:32:23.000Z","cveId":"CVE-2026-65596","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0, < 2.29.8 (fixed: 2.29.8)","n8n@>= 2.30.0, < 2.30.1 (fixed: 2.30.1)","n8n@< 1.123.64 (fixed: 1.123.64)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00367,"epssCheckedAt":"2026-11-12T18:09:39.467Z","kevDateAdded":null,"advisoryAliases":["GHSA-gq66-9cw5-j5jm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:32:23.000Z","fixReleasedAt":"2026-07-08T08:13:32.352Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:32:44.320Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.30.1","matchedVersion":"2.30.1","fixReleasedAt":"2026-07-08T08:21:33.484Z","daysToFix":-14,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:44.171Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.64","matchedVersion":"1.123.64","fixReleasedAt":"2026-07-08T08:13:32.352Z","daysToFix":-14,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:44.171Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.29.8","matchedVersion":"2.29.8","fixReleasedAt":"2026-07-08T08:52:18.611Z","daysToFix":-14,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:44.171Z"}]}}