https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:00:50.916849+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-77073 CVE-2026-77073 — n8n before 2.34.1 Cross-Project Credential Access via MCP 2026-10-06T11:00:50.918493+00:00

Affected: n8n-io n8n

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in different projects.