MEDIUMVulnerability
CVE-2026-77076
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Properties
- severity
- MEDIUM
- score
- 6.5
- epss_score
- 0.00287
- cve_id
- CVE-2026-77076
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- published_at
- 2026-08-20T12:16:38.997
- last_modified
- 2026-09-01T19:44:08.993
- epss_percentile
- 0.20857
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (1)
→[Weakness]Generation of Error Message Containing Sensitive Information
DESCRIBED_BY (1)
→[Source]NVD
AFFECTS_PRODUCT (2)
→[Product]
→[Product]
Explore deeper with Ninja Signal's threat intelligence graph