Security Flaw in n8n: GraphQL Node Bypasses Allowed HTTP Request Domains Restriction
Summary
GHSA-88c4-pcqm-3r9p: Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows that can integrate APIs, databases, and other services. However, prior to versions 1.123.64, 2.29.8, and 2.30.1, n8n had a vulnerability in its GraphQL node that failed to enforce restrictions on HTTP-based credentials, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from n8n's GraphQL node not enforcing the 'Allowed HTTP Request Domains' restriction on HTTP-based credentials, such as Header Auth, Basic Auth, Query Auth, and OAuth. This oversight allows authenticated users who can create or edit workflows to direct the node's endpoint to a server they control, leading to the exfiltration of restricted credentials. This issue primarily affects instances where credentials are configured with 'Allowed HTTP Request Domains' and are accessible to non-owner users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that sensitive credentials are not used in workflows that utilize the GraphQL node until the package is updated. Additionally, restrict access to workflows to only trusted users.
Conclusion
The vulnerability in n8n's GraphQL node poses a significant risk by allowing unauthorized access to sensitive credentials. It is crucial for users to update to the latest versions to mitigate this risk and ensure the security of their workflows.
See every vulnerability recorded for n8n →
FAQ
The vulnerability allows authenticated users to bypass restrictions on HTTP-based credentials in the GraphQL node, potentially leading to credential exfiltration.
Versions of n8n prior to 1.123.64, 2.29.8, and 2.30.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
As a temporary measure, restrict access to workflows that use the GraphQL node and avoid using sensitive credentials until the package is updated.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json, providing insights into potential security issues in your software.
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
