CVE-2026-59207: n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

Credentials in n8n can carry an "Allowed HTTP Request Domains" list, so a secret can only be sent to approved hosts. Admins use it to let members run workflows with a shared credential without being able to send it anywhere. The AI Agents feature did not enforce that list when an agent calls an MCP tool.

The attacker is a member-level user who has been granted use-only access to a credential that has domain restrictions. They build an agent, add an MCP tool that points at a URL on a server they run, attach the shared credential and run the agent. The request carries the credential's secret, such as an API key or token, to their server. They never see the secret in the UI, but they now hold it.

That turns use-only sharing into full secret theft. The stolen secret works against the real service with its full permissions. The advisory scores confidentiality high, since the secret leaves the instance.

The flaw needs two conditions: the module is enabled through N8N_ENABLED_MODULES=agents, and at least one credential with domain restrictions is shared with a member.

The n8n npm package before 2.27.4, and 2.28.0 before 2.28.1. It applies only when N8N_ENABLED_MODULES includes agents and a restricted credential is shared with a member-level user.

npm ls n8n

Check the module setting with your environment or container config for N8N_ENABLED_MODULES. For Docker, check the image tag.

Upgrade to n8n 2.27.4 or 2.28.1, or later.

npm install [email protected]

Short-term mitigations from the advisory, which do not fully fix the risk:

• Remove agents from N8N_ENABLED_MODULES to disable the AI Agents module.
• Share credentials only with fully trusted users.
• Audit credentials that have domain restrictions for unexpected sharing.

If a restricted credential was shared with members while the module was on, consider rotating its secret.

Review agents and workflows that members built, and look for MCP tool nodes pointing at hosts outside your approved domains while using a restricted credential. Check egress logs from the n8n host for requests to unfamiliar domains that coincide with agent runs. Look at the sharing list of each domain-restricted credential for members who should not have it.

Impact

The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials. As a result, a member-level user who had been granted use-only access to a shared credential could cause its secret to be sent to an external server they control, by pointing an MCP tool at an arbitrary URL and running the agent.

This issue only affects instances where the AI Agents module is enabled via N8N_ENABLED_MODULES=agents and at least one credential with domain restrictions has been shared with a member-level user.

Patches

The issue has been fixed in n8n version 2.28.1 and 2.27.4. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable.
• Restrict credential sharing to fully trusted users only.
• Audit credentials with domain restrictions for unexpected sharing relationships.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.