PT-2026-51414 · N8N · N8N

Vnth4Nhnt · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56348

Mitre

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-56348

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56348 · Security Note
• https://vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint · Note