Description
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n-io | n8n | 2.0.0 <2.45.5 | — |
| n8n-io | n8n | 2.46.0 <2.46.1 | — |
| n8n-io | n8n | 3.0.0 <3.0.1 | — |
| n8n-io | n8n | 0 <1.123.89 | — |
Advisories 1
- WID-SEC-2026-4192 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026