Executive brief
n8n is an automation platform used to connect different software services and automate business workflows. A security flaw in the SecurityScorecard integration allows an authorized user to redirect sensitive API tokens to a server they control. This could lead to the theft of credentials, allowing an attacker to access the organization's SecurityScorecard data and bypass intended security restrictions.
Technical details
A credential exfiltration vulnerability exists in the n8n SecurityScorecard node due to improper handling of outbound requests during report download operations. An authenticated attacker with workflow creation/modification privileges can configure the node to target an arbitrary, attacker-controlled URL. Because the node automatically attaches the SecurityScorecard API token to these outbound requests, the token is transmitted to the external host, bypassing domain-based credential restrictions. This is classified as an exposure of sensitive information (CWE-200). The issue is resolved in versions 1.123.55, 2.25.7, and 2.26.1 by ensuring credentials are not leaked to unauthorized endpoints.
Affected products
- n8n-io n8n < 1.123.55, >= 2.0.0-rc.0 < 2.25.7, >= 2.26.0 < 2.26.1
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD