Auth bypass in N8n-io N8n
CVE-2026-72771
n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared cred…
Vulnerability class: Broken Access Control
Affected products
- N8n-io N8n — versions 0, 2.32.1, 2.31.5
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)