CVE-2026-56348
n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
CVE-2026-56348 is a medium vulnerability (CVSS 5.3) in N8n, published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in n8n 2.20.0.
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
- Record
CVE-2026-56348- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-38376
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
- Record
EUVD-2026-38376- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3875-8gcx-7v46
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
Impact
The POST /rest/dynamic-node-parameters/options endpoint allowed any authenticated user to cause the n8n server to issue HTTP requests including credentials bypassing the intended restrictions on which hosts could be contacted for that credential (Allowed HTTP Request Domains). The user needed to be authenticated and have access to the credential.
Patches
The issue has been fixed in n8n version 2.20.0. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n access to fully trusted users only.
- Limit credential sharing to users who genuinely require access to those credentials.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-3875-8gcx-7v46- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
- Record
CVE-2026-56348- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.
- Record
CVE-2026-56348- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-3875-8gcx-7v46
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
Impact
The POST /rest/dynamic-node-parameters/options endpoint allowed any authenticated user to cause the n8n server to issue HTTP requests including credentials bypassing the intended restrictions on which hosts could be contacted for that credential (Allowed HTTP Request Domains). The user needed to be authenticated and have access to the credential.
Patches
The issue has been fixed in n8n version 2.20.0. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n access to fully trusted users only.
- Limit credential sharing to users who genuinely require access to those credentials.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-3875-8gcx-7v46- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-3875-8gcx-7v46
GHSA-3875-8gcx-7v46 in n8n - Patched by Root
Root has patched GHSA-3875-8gcx-7v46 in the n8n package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-3875-8gcx-7v46- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-56348 No score
CVE-2026-56348 in n8n - Patched by Root
Root has patched CVE-2026-56348 in the n8n package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-56348- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
n8nnpm |
before 2.20.0 | 2.20.0 |
n8nRoot:npm |
before 2.19.3-aikido.7 | 2.19.3-aikido.72.19.3-aikido.62.19.3-aikido.82.19.3-aikido.92.19.3-aikido.102.19.3-aikido.112.19.3-aikido.122.19.3-aikido.132.19.3-aikido.142.19.3-aikido.152.19.3-aikido.12.19.3-aikido.22.19.3-aikido.32.19.3-aikido.42.19.3-aikido.5 |
@rootio/n8nRoot:npm |
before 2.19.3-root.io.7 | 2.19.3-root.io.72.19.3-root.io.62.19.3-root.io.82.19.3-root.io.92.19.3-root.io.102.19.3-root.io.112.19.3-root.io.122.19.3-root.io.132.19.3-root.io.142.19.3-root.io.152.19.3-root.io.12.19.3-root.io.22.19.3-root.io.32.19.3-root.io.42.19.3-root.io.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46
vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint
nvd.nist.gov/vuln/detail/CVE-2026-56348