CVE-2026-77076 is an information disclosure vulnerability affecting n8n versions before 1.123.69, 2.33.4, and 2.34.1. The flaw occurs in the GraphQL node where connection-level failures cause the node to re-throw the original HTTP client error instead of wrapping it in a sanitized error type. This error contains live request headers with decrypted credential secrets, which are then stored verbatim in the execution engine's run data. This allows any authenticated user who can read execution data to access sensitive decrypted credentials.

The vulnerability allows authenticated users with read access to execution data to obtain decrypted credential secrets from stored error messages. This could lead to unauthorized use of credentials and potential compromise of connected systems or services. The CVSS 4.0 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required beyond authentication, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to execution data to trusted users only to minimize exposure of decrypted credentials. Monitor vendor communications for updates on patches or official fixes.