n8n — Data Exfiltration (CVE-2026-54304)
Date: 2026-06
Affected: n8n/n8n
Attack vector: data-exfiltration
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-54304
CWE: CWE-200
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.


Mitigations:

Architectural layers (MAESTRO):