A significant security flaw has been discovered in n8n, an open-source platform used for automating workflows. This vulnerability, identified as CVE-2026-54304, could allow unauthorized access to sensitive API tokens. Specifically, an attacker with authenticated user access and certain permissions could trick the SecurityScorecard node into sending its API token to an external, malicious website. This bypasses any domain restrictions that might have been set up, potentially exposing critical credentials.<\/p>\n
Product:<\/strong> n8n<\/p>\n Published Date:<\/strong> June 23, 2026<\/p>\n Severity:<\/strong> HIGH<\/p>\n Status:<\/strong> Analyzed<\/p>\n The vulnerability impacts n8n versions older than 1.123.55, 2.25.7, and 2.26.1. If you are running any version prior to these, your system is at risk.<\/p>\n The vulnerability has been thoroughly analyzed, and details regarding its nature and potential impact are available.<\/p>\n This vulnerability is rated as HIGH<\/strong> severity, with a CVSS score of 7.7. A high severity rating indicates that the flaw could lead to a significant impact if exploited. In this case, the main concern is the potential exposure of sensitive API tokens, which could grant an attacker unauthorized access to other systems or data linked to the compromised credential.<\/p>\n The good news is that fixes are available. Users are strongly advised to upgrade their n8n installations to one of the following patched versions immediately:<\/p>\n If an immediate upgrade is not feasible, temporary mitigation steps can help reduce the risk, though they do not fully eliminate it:<\/p>\n These workarounds should only be considered short-term measures until a full upgrade can be performed.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-rm2v-h48j-895m<\/p>\n","protected":false},"excerpt":{"rendered":" A significant security flaw has been discovered in n8n, an open-source platform used for automating workflows. This vulnerability, identified as CVE-2026-54304, could allow unauthorized access to sensitive API tokens. Specifically, an attacker with authenticated user access and certain permissions could trick the SecurityScorecard node into sending its API token to an external, malicious website. This […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[844,1089,1067,1061,1068],"class_list":["post-3771","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-api-security","tag-credential-exfiltration","tag-n8n","tag-node-js","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
n8n-nodes-base.securityScorecard<\/code> to your NODES_EXCLUDE<\/code> environment variable.<\/li>\n<\/ul>\nReferences<\/h2>\n