CVE-2026-56348

9.9 Critique

Publiée le 23/06/2026 à 00:16 · Modifiée le 24/06/2026 à 18:46 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data.

Traduire en français

Produits concernés

n8n
N8n n8n

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.1 Critique	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`
3.1	9.9 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-918

Références

https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46 Vendor Advisory
https://www.vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint Third Party Advisory

CVE-2026-56348

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs