CVE-2026-59207

MEDIUM

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

Title source: cna
STIX 2.1

Description

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.

References (3)

Core 3
Core References

Scores

CVSS v3 6.5
EPSS 0.0026
EPSS Percentile 18.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-693
Status published
Products (6)
n8n/n8n 2.28.0
n8n/n8n < 2.27.4
n8n-io/n8n < 2.27.4
n8n-io/n8n >= 2.28.0, < 2.28.1
npm/n8n 0 - 2.27.4npm
npm/n8n 2.28.0 - 2.28.1npm
Published Jul 09, 2026
Tracked Since Jul 09, 2026