GHSA-gq66-9cw5-j5jm: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Summary

The GraphQL node in n8n did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth and OAuth, unlike the HTTP Request node. An authenticated user who can create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where such a credential is usable by non-owner users are affected.

Mitigation

Fixed in n8n versions 1.123.64, 2.29.8 and 2.30.1; users should upgrade to one of these or later. If upgrading is not immediately possible, administrators should consider restricting workflow creation and editing permissions to fully trusted users only, restricting credential sharing to fully trusted users only, and auditing credentials with domain restrictions for unexpected sharing relationships. These workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database