CVE-2026-77081: Authorization Bypass Through User-Controlled Key in n8n-io n8n

CVE-2026-77081 affects n8n's GraphQL node in versions prior to 1.123.69, 2.33.4, and 2.34.1. The vulnerability arises when the Authentication parameter is set to expression mode, causing all authentication-gated credential selectors to be treated as active. If two credentials of different types are attached, the node enforces the allowed-domains policy only on the first credential but still attaches material from both. This allows an authenticated user with workflow-authoring rights to send a domain-restricted credential to an attacker-controlled endpoint, effectively exfiltrating credentials with their associated permissions.

An authenticated user with workflow-authoring rights can bypass the allowed-domains restriction in the GraphQL node and exfiltrate credentials to attacker-controlled endpoints. This could lead to unauthorized access or misuse of credentials that were intended to be domain-restricted. The vulnerability has a CVSS 4.0 score of 5.1, indicating a medium severity impact with network attack vector, low complexity, and partial authentication required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workflow-authoring rights to trusted users only and monitor for suspicious activity involving credential usage in GraphQL nodes.