UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126388

n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes

Severity
Medium 6.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.45.5, 2.46.1, 3.0.1
Weakness
Insufficiently protected credentials (CWE-522)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 2.45.5
  • From 2.46.0 before 2.46.1
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126388