CyberRota Analysis
AI-GeneratedVersions of n8n prior to 2.34.1 are vulnerable to a credential validation bypass in the MCP create_workflow_from_code tool, specifically when the authentication type is configured as an expression. This flaw allows attackers with a valid MCP Bearer API key and knowledge of a target credential ID to create unauthorized cross-project credential references, potentially leading to unauthorized access across different workflows. Organizations using n8n should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in different projects.
Related CVEs
Other vulnerabilities affecting the same vendor(s)