CVE-2026-126388: n8n credential leak — LOW

CISO Take

n8n before 2.46.1 forwards Authorization headers and basic auth credentials when an HTTP request is redirected to a different origin, because sendCredentialsOnCrossOriginRedirect defaults to true. The severity is low (CVSS 3.7, high attack complexity) because the attacker must control a redirect target or influence an expression-fed URL in a credential-using node, and there is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing. It still deserves attention in AI agent deployments, where n8n workflows often hold API keys for LLM providers, SaaS tools and internal systems that a single captured header could expose. Upgrade to n8n 2.46.1 or later, and until then disable cross-origin credential forwarding on credential-using nodes and review workflows that build URLs from untrusted input.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Low overall risk. Exploitation requires the attacker to control or influence a redirect target, or to feed a URL through an expression, which raises attack complexity. Impact is limited to confidentiality of the credentials sent in the redirected request (C:L), with no integrity or availability effect. Risk rises for workflows that fetch URLs derived from external or LLM-generated content and use privileged credentials. No known exploitation, no exploit code and no EPSS data are available at publication.

How does the attack unfold?

Initial Access

Attacker controls a redirect target or injects a URL into an expression-fed field of a credential-using n8n node.

AML.T0049

Exploitation

The node follows a cross-origin redirect and forwards the Authorization header or basic auth credentials by default.

AML.T0098

Credential Capture

The attacker endpoint logs the stored workflow credentials sent in the redirected request.

AML.T0055

Impact

Stolen credentials are reused to access connected AI services, data stores or SaaS tools.

AML.T0091

Initial Access

Attacker controls a redirect target or injects a URL into an expression-fed field of a credential-using n8n node.

AML.T0049

Exploitation

The node follows a cross-origin redirect and forwards the Authorization header or basic auth credentials by default.

AML.T0098

Credential Capture

The attacker endpoint logs the stored workflow credentials sent in the redirected request.

AML.T0055

Impact

Stolen credentials are reused to access connected AI services, data stores or SaaS tools.

AML.T0091

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.8KOpenSSF 7.016 dependentsPushed 6d ago42% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CLow

INone

ANone

What should I do?

6 steps

Upgrade n8n to 2.46.1 or later.
Where an upgrade is delayed, set sendCredentialsOnCrossOriginRedirect to false on credential-using nodes, or disable redirect following.
Audit workflows that build request URLs from expressions, webhooks or LLM output, and restrict them to allowlisted domains.
Rotate credentials used by nodes that contacted untrusted or redirecting endpoints.
Review egress and proxy logs for requests that carry Authorization headers to unexpected hosts.
Scope stored credentials to least privilege so a leak has limited reach.

How is it classified?

Data LeakageData ExtractionAgentFrameworkPluginAML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-126388?

n8n before 2.46.1 forwards Authorization headers and basic auth credentials when an HTTP request is redirected to a different origin, because sendCredentialsOnCrossOriginRedirect defaults to true. The severity is low (CVSS 3.7, high attack complexity) because the attacker must control a redirect target or influence an expression-fed URL in a credential-using node, and there is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing. It still deserves attention in AI agent deployments, where n8n workflows often hold API keys for LLM providers, SaaS tools and internal systems that a single captured header could expose. Upgrade to n8n 2.46.1 or later, and until then disable cross-origin credential forwarding on credential-using nodes and review workflows that build URLs from untrusted input.

Is CVE-2026-126388 actively exploited?

No confirmed active exploitation of CVE-2026-126388 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126388?

1. Upgrade n8n to 2.46.1 or later. 2. Where an upgrade is delayed, set sendCredentialsOnCrossOriginRedirect to false on credential-using nodes, or disable redirect following. 3. Audit workflows that build request URLs from expressions, webhooks or LLM output, and restrict them to allowlisted domains. 4. Rotate credentials used by nodes that contacted untrusted or redirecting endpoints. 5. Review egress and proxy logs for requests that carry Authorization headers to unexpected hosts. 6. Scope stored credentials to least privilege so a leak has limited reach.

What systems are affected by CVE-2026-126388?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, LLM-integrated automation pipelines, API integrations.

What is the CVSS score for CVE-2026-126388?

CVE-2026-126388 has a CVSS v3.1 base score of 3.7 (LOW).

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automationLLM-integrated automation pipelinesAPI integrations

MITRE ATLAS Techniques

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.

Exploitation Scenario

An attacker finds an n8n workflow that fetches a URL from user-supplied or LLM-generated input and authenticates with a stored API credential. The attacker supplies a URL on a server they control, or on a service with an open redirect, which answers with a redirect to an attacker-owned endpoint. n8n follows the redirect and sends the Authorization header or basic auth credentials to that endpoint. The attacker captures the credentials and reuses them against the connected service.

Weaknesses (CWE)

CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.