CVE-2026-54304 n8n SecurityScorecard Credential Exfiltration

Technical summary

The vulnerability resides in how n8n's SecurityScorecard integration node handles the report download operation. When an authenticated user configures the node to fetch reports, the platform attaches the SecurityScorecard API token to outbound HTTP requests without properly validating the destination URL against the credential's configured domain allowlist. An attacker with permissions to create or modify workflows can redirect this request to an attacker-controlled host, causing the token to be transmitted externally. The flaw is an improper enforcement of credential scope restrictions—the security control intended to limit which domains a credential can be sent to is bypassed during the download operation. This affects n8n versions 1.123.x before 1.123.55, 2.25.x before 2.25.7, and 2.26.x before 2.26.1. The vulnerability requires authenticated access and workflow authoring privileges, limiting the immediate blast radius but enabling insider threats or lateral movement scenarios.

Business impact

Compromise of SecurityScorecard credentials can lead to unauthorized access to security posture data, potentially exposing information about your organization's security metrics, vulnerabilities, and risk assessments. If SecurityScorecard is used to monitor supply chain or partner security, exfiltrated credentials could be leveraged to extract sensitive third-party risk intelligence. The attack also signals a process control failure: an authenticated user could abuse workflow permissions to exfiltrate credentials without audit trail visibility if logging is insufficient. Organizations using n8n for mission-critical integrations may face service disruption if credentials are revoked after compromise. Reputational risk exists if a breach involves exposure of security metrics or partner data via this vector.

Affected systems

n8n deployments running versions 1.123.54 and earlier, 2.25.6 and earlier, or 2.26.0 are affected if they: (1) use the SecurityScorecard node for report automation, (2) have SecurityScorecard credentials configured with domain allowlist restrictions, and (3) permit users to create or edit workflows. Community editions, self-hosted instances, and n8n Cloud deployments are all potentially vulnerable. Organizations should inventory SecurityScorecard credential usage within their n8n environment.

Exploitability

Exploitation requires valid n8n authentication and workflow authoring permissions, making this an insider threat or post-compromise lateral movement vector rather than a direct unauthenticated attack. An internal threat actor or an external attacker who has already compromised a user account with workflow modification rights can craft a malicious workflow in minutes. The attack is deterministic—no user interaction or complex setup is needed once the attacker has credentials and permissions. However, the requirement for prior authentication raises the bar compared to unauthenticated network exploits. The vulnerability is not currently tracked as exploited in the wild (KEV status: not listed) and no proof-of-concept code has been widely published, but the straightforward nature of the misconfiguration makes independent discovery and exploitation highly feasible.

Remediation

Upgrade n8n to version 1.123.55, 2.25.7, or 2.26.1 or later. The patch corrects URL validation logic to enforce credential domain allowlists during report download operations. After patching, audit recent workflow modifications involving SecurityScorecard nodes to detect suspicious configurations, and consider rotating SecurityScorecard API tokens if there is evidence of unauthorized access. Implement workflow approval processes and audit logging to detect future misconfigurations or malicious workflow edits.

Patch guidance

Apply patches from n8n's release channels: version 1.123.55 or later (1.x line), version 2.25.7 or later (2.25.x line), or version 2.26.1 or later (2.26.x line). Verify the specific version numbers in n8n's official release notes or advisory documentation before deployment. Test patches in a non-production environment first, particularly if you have custom nodes or integrations that depend on SecurityScorecard. No breaking changes are expected, and patches are designed as drop-in replacements. Schedule patching at your normal maintenance window; this does not require emergency out-of-cycle deployment unless you have evidence of active exploitation in your environment.

Detection guidance

Monitor n8n audit logs and API request logs for: (1) workflow modifications to SecurityScorecard nodes with suspicious target URLs, (2) requests from the SecurityScorecard node to domains outside your organization's known allowlist, (3) multiple rapid workflow changes by a single user, (4) execution of workflows containing SecurityScorecard nodes immediately after their creation. Network detection should flag outbound HTTP/HTTPS connections from n8n instances to unexpected hosts carrying SecurityScorecard API credentials in request headers or bodies. Check n8n's integrated audit logging, external log aggregation (if configured), and network monitoring tools. If n8n is deployed on Kubernetes or containerized infrastructure, monitor container egress traffic.

Why prioritize this

This vulnerability scores 7.7 (HIGH) due to the confidentiality impact (H) of credential exfiltration combined with network scope expansion (S:C). Although authenticated access is required, the attack is trivially executable by insider threats, and SecurityScorecard credentials often unlock access to sensitive security intelligence. Organizations with restrictive access controls and strong audit logging can deprioritize slightly, but those with shared n8n instances, legacy access models, or high-value SecurityScorecard data should treat this as urgent. The lack of active exploitation in the wild and the relative youth of the CVE allow a brief window to patch before attackers systematically test n8n instances.

Risk score, explained

CVSS 7.7 reflects: Network attack vector (AV:N)—the misconfigured workflow can be triggered remotely by any authenticated n8n user; Low complexity (AC:L)—no special conditions or timing required; Low privilege bar (PR:L)—requires basic workflow authoring rights, not administrator privileges; No user interaction (UI:N)—the attack succeeds once the workflow runs; Scope changed (S:C)—the credential reaches an external attacker system outside n8n's trust boundary; High confidentiality impact (C:H)—API tokens are directly exfiltrated; No integrity or availability impact. The score does not account for the authentication requirement as a primary control because that is factored into the CVSS severity rating conventions; attackers with valid credentials are within scope for this assessment.

Frequently asked questions