CVE-2026-77076 — n8n before 1.123.69 Credential Leak via GraphQL Node Error
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the n…
Published: 2026-08-20 · CVSS: 7.1 · CVSS 4.0
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7