Credential Exfiltration Vulnerability in n8n by n8n Team

CVE-2026-56348

What is CVE-2026-56348?

A vulnerability exists in n8n versions prior to 2.20.0 that allows authenticated users to exploit the POST /rest/dynamic-node-parameters/options endpoint. This flaw permits users to bypass the Allowed HTTP Request Domains restrictions, enabling attackers with valid credentials to send unauthorized HTTP requests from the n8n server. This can lead to the exfiltration of sensitive authentication data to untrusted hosts, compromising the integrity of user accounts and sensitive information.

References