UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126390

n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download

Severity
Medium 6.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
1.123.89, 2.45.5, 2.46.1, 3.0.1
Weakness
Insufficiently protected credentials (CWE-522)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 1.123.89
  • From 2.0.0 before 2.45.5
  • From 2.46.0 before 2.46.1
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126390