CVE-2026-126390
Deferred Deferred - Pending Action

Credential Leakage in NocoDB Node for n8n

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126390
EUVD
EUVD-2026-125175

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.89 (exc)
n8n n8n to 2.45.5 (exc)
n8n n8n to 2.46.1 (exc)
n8n n8n to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a credential leakage issue in n8n's NocoDB node. When downloading attachments, the configured NocoDB API token is sent to attacker-controlled hosts. An attacker with write access to a NocoDB attachment cell can insert a malicious URL, causing the API token to be exposed during workflow execution if the Download Attachments feature is enabled.

Detection Guidance

Check n8n version with 'n8n --version' to see if it is below 1.123.89, 2.45.5, 2.46.1, or 3.0.1. Inspect workflows using NocoDB nodes for Download Attachments enabled. Review NocoDB attachment cells for suspicious URLs pointing to external hosts.

Impact Analysis

The impact includes unauthorized access to sensitive data via the leaked API token, potential data breaches, and compromise of NocoDB resources. Attackers could use the token to interact with the NocoDB API as the legitimate user, leading to further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data privacy) due to unauthorized exposure of sensitive credentials and potential data breaches. Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade n8n to version 1.123.89 or later. Disable Download Attachments in NocoDB nodes. Restrict write access to NocoDB attachment cells. Rotate NocoDB API tokens. Enable SSRF protection in n8n configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...