"Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

What it is

An n8n authorization flaw (GHSA-h44j-f5r5-ph73, rated High, CVSS v4 7.1). The AI Agents feature ignored the "Allowed HTTP Request Domains" restriction on credentials. A member with use-only access to a shared credential could therefore get its secret sent to a server they control.

How it works

The attacker points an MCP tool at an arbitrary URL and runs the agent. The agent attaches the credential to that request without checking the domain allowlist. The page gives no further technical detail.

Preconditions / Affected

Both conditions must hold:

• The AI Agents module is enabled with N8N_ENABLED_MODULES=agents.
• At least one credential with domain restrictions has been shared with a member-level user.

The CVSS v4 vector reads Network, Low complexity, Low privileges, no user interaction. It also lists Attack Requirements as Present. Confidentiality impact is High on both the vulnerable and subsequent systems. Integrity is Low on both, and availability is None.

What to do

Upgrade to 2.28.1 or 2.27.4, or later. If you can't upgrade immediately, the advisory suggests these temporary mitigations:

1. Disable the module by removing agents from the N8N_ENABLED_MODULES environment variable.
2. Restrict credential sharing to fully trusted users only.
3. Audit domain-restricted credentials for unexpected sharing relationships.

The advisory gives no detection query or log signature. It also doesn't say whether to rotate secrets. The page doesn't address whether exposure has already occurred, so treat a restricted credential shared with a member on an agents-enabled instance as potentially exposed. That is an inference, not something the advisory states.

Caveats

The advisory says the workarounds "do not fully remediate the risk" and are short-term only. Only patching closes the issue.