CVE-2026-126388: n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes
n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.
Event History
Frequently Asked Questions
Which deployments are exposed?
n8n deployments running versions before 2.46.1 are exposed when credential-using nodes follow a cross-origin redirect. The risky behavior is enabled by default because sendCredentialsOnCrossOriginRedirect defaults to true.
What does an attacker need to exploit this?
An attacker needs to control the redirect target, or cause a credential-using node to use an expression-fed URL that leads to an attacker-controlled endpoint. No authentication or user interaction is required according to the supplied vector.
What information can be exposed?
Authorization headers and basic authentication credentials stored for workflows can be forwarded to the attacker-controlled redirect destination. The reported impact is confidentiality loss; integrity and availability impact are not indicated.
What can be done if upgrading is not immediately possible?
Avoid allowing credential-using nodes to request expression-fed or otherwise untrusted URLs, and avoid workflows that can be redirected to untrusted cross-origin destinations. Review redirect targets and URL inputs for nodes that use stored credentials.