PT-2026-6656 · N8N · N8N

Weblover12 · Published 2026-02-04 · Updated 2026-02-06 · CVE-2026-25631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.121.0

Description n8n is a workflow automation platform. A flaw in the HTTP Request node’s credential domain validation could allow an authenticated attacker to send requests with credentials to unintended domains, potentially resulting in credential exfiltration. This issue specifically impacts users who have credentials with wildcard domain patterns (e.g., *.example.com) configured in the "Allowed domains" setting. The vulnerable component is the HTTP Request node. The vulnerable setting is the "Allowed domains" setting.

Recommendations Versions prior to 1.121.0 should be upgraded to version 1.121.0 or later. Replace wildcard domain patterns with explicit domain listings in HTTP Request credentials. Review and restrict workflow creation/modification permissions to trusted users only. Audit existing workflows using HTTP Request nodes with domain-restricted credentials.

Exploit

Fix

Insufficiently Protected Credentials

RCE

Weakness Enumeration

CWE-522

CWE-20

Related Identifiers

CVE-2026-25631

GHSA-2XCX-75H9-VR9H

Affected Products

N8N

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25631.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25631 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xcx-75h9-vr9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25631 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h · Note
• https://twitter.com/CVEnew/status/2019876691322237222 · Twitter Post