CVE-2026-54304

n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

State: Published
Severity: 7.1 High
Published: Jun 23, 2026
Updated: Jun 23, 2026
Reserved: Jun 12, 2026

Description

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
n8nn8n-io	< 1.123.55Affected >= 2.26.0, < 2.26.1Affected >= 2.0.0-rc.0, < 2.25.7Affected

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.