The vulnerability in n8n involves a bypass of the "Allowed HTTP Request Domains" credential allowlist in multiple AI and LLM nodes. This allowlist is intended to restrict which hosts can receive a credential's secret, protecting shared credentials from misuse by users who can use but not view them. Due to improper enforcement when a user-supplied base or endpoint URL is set, a low-privileged workflow editor with use-only access to a shared credential can redirect requests to an attacker-controlled host, causing the credential secret to be leaked. This enables the attacker to reuse the credential against the underlying service. The vulnerability only affects credentials with domain restrictions configured and shared with non-owner users. The issue has been fixed in n8n versions 2.31.5 and 2.32.1.

An attacker with low privileges and use-only access to a shared credential can cause the credential secret to be transmitted to an attacker-controlled host by exploiting the bypass in the domain restriction. This leads to credential leakage and potential unauthorized access to the underlying service using the stolen credential. The impact is high because it compromises the confidentiality of shared credentials intended to be protected by domain restrictions.

A fix is available in n8n versions 2.31.5 and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If immediate upgrade is not possible, administrators should restrict workflow creation and editing permissions to fully trusted users, restrict credential sharing to fully trusted users, and audit credentials with domain restrictions for unexpected sharing relationships. These workarounds do not fully remediate the risk and should only be used as short-term measures.