GHSA-64xh-79j6-r5v8: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

The credential “Allowed HTTP Request Domains” allowlist was intended to restrict which hosts a credential’s secret could be sent to, protecting shared credentials from users who could use but not view them. Several AI/LLM nodes did not enforce this allowlist when a user-supplied base or endpoint URL was set. A low-privileged workflow editor with use-only access to such a shared credential could point one of these nodes at an attacker-controlled host and cause the credential secret to be transmitted there, then reuse it against the underlying service.

Only instances where a credential has “Allowed HTTP Request Domains” configured and is shared with non-owner users are affected.