Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Published: 2026-08-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Disclosure
Action: Patch Immediately
AI Analysis

Impact

The vulnerability allows information disclosure by returning the underlying HTTP client error during a GraphQL request failure. The error contains request headers that include a decrypted credential secret. The execution engine persists this error message unchanged, so any authenticated user who can read the run data can recover the credential secret.

Affected Systems

n8n-io’s n8n before 1.123.69, before 2.33.4, and before 2.34.1 are affected. The GraphQL node in these releases is the source of the issue.

Risk and Exploitability

The CVSS score is 7.1, indicating a high severity impact when exploited. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploit yet. Attackers must be authenticated to DB and able to trigger a GraphQL request that fails at the connection level; the resulting stored error then exposes the credential secret.

Generated by OpenCVE AI on August 20, 2026 at 22:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all n8n installations to version 1.123.69 or newer, or 2.33.5 or newer
  • Restrict reading of execution data to only those users who require it
  • Adjust logging configuration to exclude request headers and raw error payloads from execution logs

Generated by OpenCVE AI on August 20, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
cpe:2.3:a:n8n:n8n:2.34.0:*:*:*:*:node.js:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Fri, 21 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Title n8n before 1.123.69 Credential Leak via GraphQL Node Error
First Time appeared N8n
N8n n8n
Weaknesses CWE-209
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
Vendors & Products N8n
N8n n8n
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

N8n N8n
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-21T16:43:12.650Z

Reserved: 2026-08-20T10:51:39.784Z

Link: CVE-2026-77076

cve-icon Vulnrichment

Updated: 2026-08-21T16:43:06.687Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T12:16:38.997

Modified: 2026-09-01T19:44:08.993

Link: CVE-2026-77076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:02:06Z

Weaknesses
  • CWE-209

    Generation of Error Message Containing Sensitive Information