Information Disclosure Vulnerability in n8n by n8n-io

CVE-2026-77076

What is CVE-2026-77076?

Earlier releases of n8n (prior to versions 1.123.69, 2.33.4, and 2.34.1) have a significant information disclosure vulnerability within the GraphQL node. When a GraphQL request encounters a connection-level failure, the system incorrectly rethrows the underlying HTTP client error without applying n8n's standard error handling. This oversight allows the error to expose sensitive request headers, including decrypted credential secrets, which are stored redundantly by the execution engine. Any authenticated user with access to the execution logs can potentially retrieve these sensitive credentials, creating a critical security risk.

References