Skip to content
Threat Feed
Subscribe

Tag

Restriction-Bypass

1 brief RSS
low advisory

n8n AI Agents Module Restriction Bypass via MCP Connector (CVE-2026-59207)

The n8n AI Agents module in versions prior to 2.27.4 and between 2.28.0 and 2.28.1 failed to enforce configured 'Allowed HTTP Request Domains' restrictions, allowing an authenticated member-level user with 'use-only' access to a shared credential to bypass these domain restrictions and exfiltrate sensitive secrets to an attacker-controlled server.

n8n +1 vulnerability restriction-bypass data-exfiltration ai-agents
1t 1c