AI Threat Alert
CVE-2026-25631
MEDIUMn8n is the de facto orchestration layer for AI agent pipelines — it holds API keys to OpenAI, Anthropic, vector DBs, and every downstream service your agents touch. Any authenticated user (insider, compromised service account, low-priv contractor) can exfiltrate those credentials if wildcard domain patterns are configured. Patch to 1.121.0 immediately and audit every HTTP Request node for wildcard Allowed Domains entries.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
Severity & Risk
Recommended Action
- 1) Patch: Upgrade n8n to 1.121.0 or later — this is the only full fix. 2) Audit: Enumerate all HTTP Request nodes using credentials with wildcard patterns (*.example.com); replace wildcards with explicit FQDN allowlists. 3) Rotate: Assume any credential attached to a wildcard-configured HTTP Request node is compromised; rotate immediately. 4) Access control: Restrict n8n workflow edit permissions — not every user needs the ability to create or modify HTTP Request nodes. 5) Detection: Monitor outbound HTTP from n8n for requests to unexpected domains, especially subdomains of otherwise-trusted domains. 6) Segment: If running n8n in a shared environment, isolate it from high-value credential stores.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. This issue is fixed in version 1.121.0 and later.
Exploitation Scenario
Attacker gains low-privilege access to an n8n instance (e.g., via phishing a workflow developer or reusing a leaked n8n account). They identify an HTTP Request node that uses a credential configured with 'Allowed domains: *.internal-corp.com'. The attacker creates or modifies a workflow to send a request to 'exfil.attacker-controlled.com' — or more subtly, registers 'attacker.internal-corp.com' if the wildcard is broader than intended. The n8n credential domain validation passes the wildcard check, attaches the stored API key or token to the outbound request, and the credential is delivered to the attacker's endpoint. In AI agent deployments, this credential often grants access to LLM APIs, vector databases, or connected SaaS tools used by the agent pipeline.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N