Insertion of Sensitive Information Into Sent Data in n8n - CVE-2026-126390
Published: November 4, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU159340
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126390
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain the configured NocoDB API token.
The vulnerability exists due to disclosure of credentials to an unvalidated destination in the n8n NocoDB node when downloading attachments from record-supplied URLs with "Download Attachments" enabled. A remote attacker can place a URL pointing to a host they control in an attachment cell they can write to, causing the node to send the configured NocoDB API token to that host when the workflow next executes.
Affected software
n8n
How to mitigate CVE-2026-126390
Install security update from vendor's website.
n8n - addressed in versions 1.123.89, 2.45.5, 2.46.1, 3.0.1