n8n AI Agents Credential Domain Restriction Bypass via MCP Connector (CVE-2026-9207)

Vulnerability Overview Vulnerability Name: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector Vulnerability ID: GHSA-h44j-f5r5-ph73 Severity: High (7.1 / 10) Publication Date: 2 weeks ago Affected Versions Affected Versions: - = 2.28.1 - >= 2.27.4 Description Impact: - The AI Agents feature does not enforce the configured "Allowed HTTP Request Domains" restrictions. - Members-level users granted permission to use access shared credentials may have their secrets exfiltrated to arbitrary URLs they control and run agents. - This issue only affects instances where the AI Agents module is enabled via the environment variable and at least one credential with domain restrictions is shared with members-level users. Remediation Patch: - The issue has been fixed in n8n versions 2.28.1 and 2.27.4. - Users should upgrade to these versions or later to mitigate the vulnerability. Temporary Workarounds If immediate upgrading is not feasible, administrators should consider the following temporary workarounds: - Disable the AI Agents module by removing from the environment variable. - Restrict credential sharing to fully trusted users. - Audit credentials with domain restrictions to identify unexpected sharing relationships. CVSS v4 Base Metrics Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: Low User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None Subsequent System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None CVE ID CVE-2026-9207 Weaknesses No CWE Credits Reporter: trap-bytes

Goal Reached Thanks to every supporter — we hit 100%!

n8n AI Agents Credential Domain Restriction Bypass via MCP Connector (CVE-2026-9207)

More from this source