n8n versions before 2.32.1 do not enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. An attacker who has low-privileged access to a workflow editor can instruct the system to send requests to a host they control, which allows the exported credential secrets to be sent to that host for reuse against underlying services. The vulnerability enables the exfiltration of credential secrets and can lead to unauthorized access to services operating under those credentials.

All releases of n8n by n8n-io prior to version 2.32.1 are affected. Low-privileged workflow editors with use-only access to shared credentials can exploit the flaw if AI or LLM nodes are used with user-configured URLs.

The CVSS score of 7.1 indicates a high severity for this credential theft flaw, but the EPSS score is not available and the vulnerability is not listed in CISA KEV. According to the description, exploitation requires an attacker to possess a low-privileged editor account and the ability to configure AI and LLM nodes with arbitrary base or endpoint URLs. Once those conditions are met, the attacker can redirect requests to malicious endpoints and exfiltrate sensitive credential information, enabling further compromise of downstream services.