CVE-2026-54304: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
Impact An authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating.
Patches The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the SecurityScorecard node by adding n8n-nodes-base.securityScorecard to the NODESEXCLUDE environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.25.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.26.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.55 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.55 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.25.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.26.1 - Configuration
Disable the SecurityScorecard node by adding `n8n-nodes-base.securityScorecard` to the `NODES_EXCLUDE` environment variable.
n8n NODES_EXCLUDE = n8n-nodes-base.securityScorecard - Configuration
Limit workflow creation and editing permissions to fully trusted users only.
n8n workflow creation/edit permissions = fully trusted users only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54304?
The severity of CVE-2026-54304 is high with a score of 7.7.
What impact does CVE-2026-54304 have on security?
CVE-2026-54304 allows an authenticated user to configure download operations targeting an attacker-controlled URL, leading to potential information leakage.
How do I fix CVE-2026-54304?
To fix CVE-2026-54304, ensure adequate access controls are implemented and restrict the modification of workflows related to report downloads.
Which software is affected by CVE-2026-54304?
CVE-2026-54304 affects the npm/n8n software.
Who is at risk for CVE-2026-54304?
Authenticated users with permission to create or modify workflows within n8n are at risk for CVE-2026-54304.