CVE-2026-126390: n8n NocoDB node leaks API token on

CISO Take

n8n before 1.123.89 has a flaw in its NocoDB node that sends the configured NocoDB API token to whatever host an attachment URL points to when Download Attachments is enabled. This is a low-severity issue (CVSS 3.7, high attack complexity) with no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template, so mass exploitation is unlikely today. The real risk is narrower: anyone with write access to a NocoDB attachment cell can plant a URL they control and capture a token that may grant broad access to your NocoDB data, and n8n is widely used to orchestrate AI agent workflows. Upgrade n8n to 1.123.89 or later, and rotate any NocoDB API tokens used in workflows that download attachments. Prioritize this after higher-severity patches, but do not skip the token rotation if untrusted users can edit NocoDB tables.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Low overall. The CVSS vector (AV:N/AC:H/PR:N/UI:N, C:L) reflects that the attack needs a precondition: the attacker must be able to write a URL into an attachment cell that a workflow later processes with Download Attachments on. There is no known exploitation, no public exploit and no EPSS data. Impact is limited to confidentiality of the leaked NocoDB token, but the token's scope (often a full-access API token) determines the real-world damage. Exposure is highest where NocoDB tables accept input from external or low-trust contributors.

How does the attack unfold?

Initial Access

Attacker with write access to a NocoDB attachment cell inserts a URL pointing to an attacker-controlled host.

AML.T0012

Exploitation

An n8n workflow runs the NocoDB node with Download Attachments enabled and sends the API token to the attacker's host.

AML.T0098

Credential Capture

The attacker's server logs the NocoDB API token from the incoming request.

AML.T0025

Impact

The attacker reuses the token to read or modify NocoDB data that feeds AI and automation workflows.

AML.T0091.000

Initial Access

Attacker with write access to a NocoDB attachment cell inserts a URL pointing to an attacker-controlled host.

AML.T0012

Exploitation

An n8n workflow runs the NocoDB node with Download Attachments enabled and sends the API token to the attacker's host.

AML.T0098

Credential Capture

The attacker's server logs the NocoDB API token from the incoming request.

AML.T0025

Impact

The attacker reuses the token to read or modify NocoDB data that feeds AI and automation workflows.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.8KOpenSSF 7.016 dependentsPushed 6d ago42% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.89 or later. 2) Rotate all NocoDB API tokens configured in n8n credentials, especially if untrusted users can edit attachment fields. 3) Until patched, disable Download Attachments in NocoDB nodes or restrict write access to attachment cells. 4) Apply least privilege to NocoDB tokens (scoped, read-only where possible). 5) Add egress filtering from the n8n host to allow only known NocoDB endpoints. 6) Review n8n execution logs and outbound proxy logs for requests to unexpected hosts carrying Authorization or xc-token headers, and audit NocoDB access logs for token use from unfamiliar IPs.

How is it classified?

Data LeakageData ExtractionAgentPluginFrameworkAML.T0025- Exfiltration via Cyber Means AML.T0091.000- Application Access Token AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Security of AI system resources

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency / Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-126390?

n8n before 1.123.89 has a flaw in its NocoDB node that sends the configured NocoDB API token to whatever host an attachment URL points to when Download Attachments is enabled. This is a low-severity issue (CVSS 3.7, high attack complexity) with no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template, so mass exploitation is unlikely today. The real risk is narrower: anyone with write access to a NocoDB attachment cell can plant a URL they control and capture a token that may grant broad access to your NocoDB data, and n8n is widely used to orchestrate AI agent workflows. Upgrade n8n to 1.123.89 or later, and rotate any NocoDB API tokens used in workflows that download attachments. Prioritize this after higher-severity patches, but do not skip the token rotation if untrusted users can edit NocoDB tables.

Is CVE-2026-126390 actively exploited?

No confirmed active exploitation of CVE-2026-126390 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126390?

1) Upgrade n8n to 1.123.89 or later. 2) Rotate all NocoDB API tokens configured in n8n credentials, especially if untrusted users can edit attachment fields. 3) Until patched, disable Download Attachments in NocoDB nodes or restrict write access to attachment cells. 4) Apply least privilege to NocoDB tokens (scoped, read-only where possible). 5) Add egress filtering from the n8n host to allow only known NocoDB endpoints. 6) Review n8n execution logs and outbound proxy logs for requests to unexpected hosts carrying Authorization or xc-token headers, and audit NocoDB access logs for token use from unfamiliar IPs.

What systems are affected by CVE-2026-126390?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation pipelines, RAG ingestion pipelines.

What is the CVSS score for CVE-2026-126390?

CVE-2026-126390 has a CVSS v3.1 base score of 3.7 (LOW).

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation pipelinesRAG ingestion pipelines

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0091.000Application Access Token

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

Exploitation Scenario

An attacker with contributor access to a shared NocoDB table (for example a form-fed intake table) inserts an attachment entry whose URL points to a server they control. When a scheduled n8n workflow, such as an AI document-processing or agent pipeline, runs the NocoDB node with Download Attachments enabled, n8n fetches the attacker's URL and includes the NocoDB API token in the request. The attacker's server logs the token and then uses it to read or modify NocoDB data directly, potentially poisoning data that downstream AI workflows consume.

Weaknesses (CWE)

CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.