CVE-2026-126390: n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.123.89
Event History
Frequently Asked Questions
Which workflows are exposed?
Workflows using the NocoDB node are exposed when Download Attachments is enabled and the node is configured with a NocoDB API token. The issue affects n8n versions before 1.123.89.
What does an attacker need to exploit this?
An attacker needs write access to a NocoDB attachment cell so they can place a URL pointing to a host they control. They must then cause or wait for a workflow with Download Attachments enabled to execute.
What is leaked if exploitation succeeds?
The configured NocoDB API token is sent to the attacker-chosen host during attachment download. The provided data indicates confidentiality impact only; it does not indicate integrity or availability impact.