The vulnerability an authenticated attacker within the n8n environment to bypass the intended domain allowlist for the HTTP Request node, sending requests that include stored credentials to arbitrary or unintended domains. This bypass can result in exfiltration of credential data, putting sensitive authentication information at risk. The weakness is rooted in improper input validation (CWE‑20) and the mishandling of stored credentials (CWE‑522).

n8n, the open-source workflow automation platform, is affected when it runs a version prior to 1.121.0. The problem specifically targets users who have defined credentials that use wildcard domain patterns, such as "*.example.com", in their allowed domains configuration. Resident on a Node.js runtime, the issue exists across all installations that employ the HTTP Request node with such settings, regardless of deployment size.

The scoring reflects a moderate risk (CVSS score 5.3) and a very low likelihood of exploitation (EPSS < 1 %). The vulnerability is not listed in CISA’s KEV catalog. An attacker must have authenticated and authorized access to modify the HTTP Request node configuration, or the node must be improperly exposed to external users. Exploitation relies on the missing domain validation check; once the advance is in place, an attacker could cause the system to send credentials to a domain of their choice, potentially leaking authentication material to an external server.