n8n, a popular workflow automation tool, has been found to contain a critical security flaw that could put sensitive information at risk. This vulnerability, identified as CVE-2026-56348, allows authenticated attackers to bypass certain security measures, potentially leading to the theft of credentials. It’s a serious concern for anyone using n8n, whether for community or enterprise purposes.
The issue lies within a specific part of n8n, an endpoint called `POST /rest/dynamic-node-parameters/options`. Normally, n8n has safeguards to control which external websites it can interact with when using saved credentials. However, this vulnerability allows an authenticated user to trick the n8n server. The server can then be forced to send HTTP requests, including sensitive authentication data, to external hosts that were not supposed to be allowed. This means an attacker who has gained initial access could steal valuable login information.
CVE Details
- Product: n8n
- Published Date: June 22, 2026
- Severity: CRITICAL (CVSS Score 9.1)
- Status: Analyzed
Affected Products
This vulnerability affects all versions of n8n prior to 2.20.0. This includes both the community and enterprise editions of the Node.js application. Users running any version older than 2.20.0 are at risk and should take immediate action.
Current Status
The vulnerability is currently “Analyzed.” This means its details have been thoroughly investigated and understood by security researchers and the vendor. The n8n team has released a fix for this issue.
Severity Level
The vulnerability is rated as **CRITICAL**, with a CVSS score of 9.1. This high rating reflects the significant danger it poses. The primary risk is credential exfiltration, which means an attacker could steal sensitive login information. While some analyses, such as a GitHub advisory, rated this specific issue as “Moderate” (CVSS 4.0 score 5.3), the overall impact of credential theft in a workflow automation context, where numerous integrations and services might rely on stored credentials, justifies the critical classification given in the original vulnerability report. Successful exploitation could lead to unauthorized access to various systems and data connected through n8n.
Possible Solutions
The good news is that n8n has already provided a fix for this critical vulnerability.
- Upgrade to n8n 2.20.0 or later: The most effective solution is to update your n8n installation to version 2.20.0 or any newer release. This update includes the necessary patches to close the security loophole.
- Temporary Workarounds (if immediate upgrade is not possible):
- Restrict User Access: Limit who can access your n8n instance to only fully trusted users.
- Limit Credential Sharing: Ensure that sensitive credentials are only shared with users who absolutely need them to perform their tasks.
It’s important to remember that these workarounds are temporary. They reduce the risk but do not eliminate the vulnerability entirely. Upgrading to the patched version is the definitive way to secure your n8n instance.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46
https://www.vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint
