CVE-2026-72774: n8n before 1.123.67 Authentication Bypass via HTTP Request Node
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.67 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.31.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.32.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72774?
CVE-2026-72774 has a risk score of 51, indicating a moderate severity vulnerability.
How do I fix CVE-2026-72774?
To remediate CVE-2026-72774, upgrade n8n to version 1.123.67 or later, or to version 2.31.5 or later, as these versions contain the necessary security patches.
What is CVE-2026-72774?
CVE-2026-72774 is a vulnerability in n8n prior to version 1.123.67 that allows an authenticated user to bypass credential authorization in the HTTP Request node.
Who is affected by CVE-2026-72774?
Any user of n8n versions prior to 1.123.67, 2.31.5, and 2.32.1 that has edit access to a shared workflow is affected by CVE-2026-72774.
What type of vulnerability is CVE-2026-72774?
CVE-2026-72774 is classified as an authentication bypass vulnerability in the n8n HTTP Request node.