n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
n8n
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-54304
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and online services into step-by-step workflows. This flaw affects versions before 1.123.55, 2.25.7 and 2.26.1. It is in the building block that connects workflows to the SecurityScorecard service, specifically its report download feature. A signed-in user who is allowed to create or change workflows, and who can use a saved SecurityScorecard login that is limited to certain websites, could point that feature at a server they control. The SecurityScorecard access key would then be sent to that server, getting around the limits set on the login. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it for you.
- If your own staff or volunteers run n8n, they should update it to a version that fixes this flaw:
1.123.55,2.25.7or2.26.1. Choose the fixed version that matches the version you use now, and check the vendor advisory linked on this page for details. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.