n8n AI Agent MCP Tool Credential Exfiltration via Allowed Domain Bypass
First seen Jul 9, 2026 · Updated Jul 9, 2026
A vulnerability in n8n's AI Agents feature allowed a low-privilege user with only 'use' access to a shared credential to bypass the configured Allowed HTTP Request Domains restriction by pointing an MCP tool at an arbitrary attacker-controlled URL. This let the attacker exfiltrate the credential's secret value to an external server, effectively escalating from use-only access to full credential disclosure. The issue is fixed in n8n 2.27.4 and 2.28.1.
Technical Analysis
The n8n AI Agents feature integrates MCP tools that can be configured with arbitrary target URLs at workflow-authoring time. The platform's domain allowlist (Allowed HTTP Request Domains) is intended to restrict which external endpoints a credential-bound HTTP request can reach, but this restriction was not enforced when the request originated from an MCP tool invocation within an AI Agent node. A member-level user with only 'use' permission on a shared credential (not full edit/view access) could configure or manipulate an MCP tool to send a request carrying the credential's secret to a domain of their choosing, bypassing the intended access boundary. This crosses a tool-layer trust boundary: the AI agent's tool execution path had weaker authorization enforcement than the platform's standard credential-usage path, turning a benign 'use-only' grant into an exfiltration primitive.
Affected Systems
n8n; protocols: MCP
Detection Signatures
- Outbound HTTP requests from n8n workflow execution logs to domains not present in the configured Allowed HTTP Request Domains list
- MCP tool node configurations with attacker-controlled or unexpected target URLs
- Credential secret values appearing in request bodies/headers to non-allowlisted external hosts
- Workflow executions by member-level users invoking MCP tools against newly added or unusual domains
- Discrepancy between credential permission level (use-only) and outbound destinations reached during execution
Remediation Steps
- 1
Upgrade n8n
Update to n8n 2.27.4, 2.28.1, or later where the Allowed HTTP Request Domains restriction is properly enforced for MCP tool invocations within AI Agent nodes.
- 2
Audit credential permissions
Review all shared credentials and their 'use-only' grants to identify which member-level users had access, and rotate any credentials that could have been exposed prior to patching.
- 3
Review MCP tool configurations
Audit existing workflows for MCP tools pointing to unexpected or externally-controlled URLs, especially those configured by non-admin users.
- 4
Enforce network egress controls
Apply infrastructure-level egress filtering (firewall/proxy allowlisting) as a defense-in-depth measure independent of the application-layer domain restriction.
- 5
Monitor outbound traffic
Implement logging and alerting for n8n instance outbound connections that fall outside expected domain patterns, particularly from AI Agent/MCP tool executions.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.