n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
n8n
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-56348
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 22, 2026
- Source last modified
- July 20, 2026
Description
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting different apps and online services. This flaw affects versions before 2.20.0. A person who can sign in to n8n and has access to stored credentials (the saved passwords and keys n8n uses to reach other services) can get around the setting that limits which outside sites n8n may send web requests to. Through a part of the product, they can make the n8n server send those credentials to sites that are not allowed, so sensitive login information can be stolen. This flaw is rated Critical.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it for you.
- If you run n8n yourselves, update it to version
2.20.0or later, which fixes this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update to
2.20.0or later will be done. - No workaround is named for this flaw, so updating is the fix. For any further details, check the vendor advisory linked on this page.
Analysis written from the source record as of July 20, 2026 and reviewed before publishing.