CVE-2026-77073

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

EUVD-2026-63262

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-77073

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. An attacker with a valid MCP Bearer API key and a target credential ID can persist unauthorized cross-project credential references on work...

CVE-2026-77073: Authorization Bypass Through User-Controlled Key

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

PT-2026-78929

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 Description A credential validation bypass exists in the MCP create workflow from code tool when the authentication type is configured as an expression. An attacker possessing a valid MCP Bearer API key and a targe...

PT-2021-12650

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to 9 with Syracuse 9.22.7.2 Sage X3 HR & Payroll Version 9 with Syracuse 9.24.1.3 and earlier Sage X3 Version 11 with Syracuse 11.25.2.6 and earlier Sage X3 Version 12 with Syracuse 12.10.2.8 and earlier Description: Th...