CVE Intelligence
Analysis AI-assisted

CVE-2026-56348: n8n Credential Exfiltration via Allowed HTTP Request Domains Bypass

CVE-2026-56348 affects n8n versions before 2.20.0 and allows authenticated users to bypass the Allowed HTTP Request Domains restriction through the POST /rest/dynamic-node-parameters/options endpoint. The record describes a path that can lead the n8n server to send credentials to unauthorized hosts. NVD lists a CVSS 3.1 base score of 9.9 (critical), while the record shows no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56348 is a credential exfiltration issue in n8n, a workflow automation platform. According to the record, the flaw is in the POST /rest/dynamic-node-parameters/options endpoint and lets authenticated users get around the Allowed HTTP Request Domains restriction. The weakness is classified as CWE-918 (Server-Side Request Forgery).

Impact

  • The record states that requests carrying credentials can be sent from the n8n server to unauthorized hosts, which may expose sensitive authentication data.
  • NVD scores the issue at 9.9 under CVSS 3.1 with high confidentiality, integrity and availability impact and scope change.
  • A second CVSS entry from the CNA shows 9.1 under 3.1 and 5.3 under 4.0, so scoring differs between providers.

Affected products and versions

  • n8n (product listed as N8n N8n) in versions before 2.20.0.
  • No fixed version is listed in the record's fix field; the affected range implies 2.20.0 as the first unaffected release, which should be confirmed in the vendor advisory.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade n8n to 2.20.0 or later, as indicated by the affected range, and verify against the vendor advisory.
  • Until upgraded, restrict who holds authenticated access to n8n, since the record requires authenticated users.
  • Review and rotate credentials stored in n8n workflows if there is reason to believe unauthorized outbound requests occurred.
  • Limit outbound network egress from the n8n host to only necessary destinations, as a defense-in-depth measure.

Detection guidance

  • Review n8n logs for requests to the dynamic-node-parameters endpoint from unexpected accounts.
  • Monitor outbound HTTP traffic from the n8n server for connections to hosts not on the approved list.
  • Audit recent changes to workflows and credential usage.

Limitations of the available information

The record does not include a fixed version field, EPSS score, SSVC data or exploitation evidence. Scoring differs between NVD and the CNA. Details of the exploitation conditions beyond the summary are not in the record, and this analysis does not include technical attack steps.

Frequently asked questions

Which n8n versions are affected by CVE-2026-56348?

The record lists n8n versions before 2.20.0 as affected. No fixed version field is provided, so the vendor advisory should be checked to confirm the first fixed release.

Is CVE-2026-56348 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

What is the severity of CVE-2026-56348?

NVD lists a CVSS 3.1 base score of 9.9 (critical). The CNA reports 9.1 under CVSS 3.1 and 5.3 under CVSS 4.0, so scores differ by provider.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.