Based on the description, the flaw involves an absence of enforcement of the Allowed HTTP Request Domains restriction in the AI Agents feature of n8n. A member‑level user with use‑only access to a shared credential can direct an MCP connector at any arbitrary URL. Because the restriction is not applied, the credential’s secret can be delivered to an attacker‑controlled external server, exposing the credential secret and indicating an improper control of security‑relevant information.

Vulnerable versions of n8n are those prior to 2.27.4 and 2.28.1. Deployments that enable the AI Agents feature with use‑only shared credentials granted to member‑level users fall under the affected user model.

The CVSS score of 7.1 indicates a high impact with a modest effort required for exploitation. An EPSS score of < 1% suggests a very low but non‑zero probability of real‑world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker could use an arbitrary external endpoint to receive the credential secret without needing elevated privileges.