by Kastro
Paper/Archive/CVE-2026-56348

CVE-2026-56348

n8n n8n — n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.

Affected

ProductAffectedFixed inSource
n8n< 2.20.02.20.0CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
VulnCheck (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46writeupvulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint