Credential Exfiltration in n8n Workflow Automation

Executive Summary

This vulnerability exists in n8n versions before 2.20.0 and involves the POST /rest/dynamic-node-parameters/options endpoint. It allows authenticated users to bypass the restrictions set by Allowed HTTP Request Domains. As a result, attackers who have access to credentials can make the n8n server send HTTP requests with those credentials to unauthorized hosts, leading to the exfiltration of sensitive authentication data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive authentication credentials. Attackers with credential access can exploit this flaw to make the n8n server send requests to unauthorized external hosts, potentially leaking confidential authentication data. This can result in compromised accounts, unauthorized access to systems, and further exploitation of connected services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows exfiltration of sensitive authentication data by bypassing domain restrictions, which could lead to unauthorized disclosure of personal or sensitive information.

Such unauthorized data exposure may impact compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and prevention of unauthorized access or disclosure.

Organizations using affected versions of n8n should upgrade to version 2.20.0 to mitigate this risk and help maintain compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-56348 vulnerability, the primary and most effective step is to upgrade n8n to version 2.20.0 or later, where the issue has been patched.

As temporary mitigations before upgrading, restrict access to the n8n server to trusted users only and limit the sharing of credentials within the system. However, these measures do not fully resolve the risk.

Useful 0 Not Useful 0