{"id":"EUVD-2026-38479","enisaUuid":"1f3a941c-995a-3b05-8359-712e6cdd4c30","description":"n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node\u0027s report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.","datePublished":"Jun 23, 2026, 3:48:44 PM","dateUpdated":"Jun 23, 2026, 5:18:31 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m\n","aliases":"CVE-2026-54304\nGHSA-rm2v-h48j-895m\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"193e990e-219d-3427-b4c9-976d1fc1dff4","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.55"},{"id":"4ea8ceb2-a2ef-34ea-a3ec-070a66da6eee","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.1"},{"id":"7a633de5-64ec-32cf-a3e0-f1831a74a3e0","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.25.7"}],"enisaIdVendor":[{"id":"e2f34850-73bc-3bdb-a5c2-c4825db6bfc5","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"892e3ec5-fbff-3bf3-b0eb-f44ea9c65a2e","vulnerability":{"id":"CVE-2026-54304","description":"n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node\u0027s report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.","datePublished":"Jun 23, 2026, 3:48:44 PM","dateUpdated":"Jun 23, 2026, 5:18:31 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m\n","enisa_id":"EUVD-2026-38479\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 30, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"3948d88a-c6f2-399c-a663-3d45ecd779d4","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.25.7"},{"id":"5044d93a-10df-35e9-9405-c86a9dc619bf","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.55"},{"id":"f00b3df1-eece-3dee-8788-8ccb6e402cb1","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.1"}],"vulnerabilityVendor":[{"id":"5a32d7c8-f800-3548-a50b-c2d6fe7b3ad4","vendor":{"name":"n8n-io"}}]}},{"id":"da49a6e8-274e-32a3-a700-78ef43de96ff","vulnerability":{"id":"GHSA-rm2v-h48j-895m","description":"n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host","datePublished":"Jun 16, 2026, 11:34:10 PM","dateUpdated":"Jul 20, 2026, 1:44:57 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54304\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38479\n","aliases":"CVE-2026-54304\nGHSA-rm2v-h48j-895m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"868ababf-dec3-3c3a-8569-070596595b94","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}