CVE-2026-59207— n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59207
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
Source: NVD (National Vulnerability Database)
Vulnerability Description
n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
保护机制失效
Source: NVD (National Vulnerability Database)
Vulnerability Title
n8n 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
n8n是n8n公司开源的一个可扩展的工作流自动化工具。 n8n存在处理逻辑错误漏洞，该漏洞源于AI Agents功能未在MCP工具指向任意URL时强制执行凭据上配置的Allowed HTTP Request Domains限制，可能导致拥有只使用共享凭据权限的成员级用户将凭据秘密发送到其控制的外部服务器。以下版本受到影响：2.27.4之前版本和2.28.0至2.28.1之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59207
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59207
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59207 (1)
- 🔗 Release n8n@2.27.4 · n8n-io/n8n · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-59207 (1)
Vendor Pages for CVE-2026-59207 (1)
- 🔗 Release n8n@2.28.1 · n8n-io/n8n · GitHubx_refsource_MISC
Same Patch Batch · n8n-io · 2026-07-09 · 4 CVEs total
| CVE-2026-59208 | n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution | |
| CVE-2026-59206 | n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Projec | |
| CVE-2026-59209 | n8n: Shared Credential Header Leak via HTTP Request Pagination Expression |
IV. Related Vulnerabilities
Same product: n8n
- CVE-2026-58661
n8n - Disk Space Exhaustion via Data-Table File Upload Endpo - CVE-2026-56354
n8n - Cross-Site Scripting and Open Redirect in Form Node - CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-59206
n8n: Prototype Pollution via Workflow Credentials Leads to U - CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject
Same vendor: n8n-io
- CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-59206
n8n: Prototype Pollution via Workflow Credentials Leads to U - CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject - CVE-2026-44792
n8n: Source Control Pull SQL Injection - CVE-2026-44791
n8n: XML Node Prototype Pollution Patch Bypass
Same weakness: CWE-693
- CVE-2026-61437
PraisonAI before 1.6.78 Remote Code Execution via tools.py - CVE-2026-60086
PraisonAI before 4.6.78 Prompt Injection Defense Bypass - CVE-2026-59854
SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles - CVE-2026-0278
Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilit - CVE-2026-59223
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter
V. Comments for CVE-2026-59207
No comments yet