CVE-2026-126388

CVSS 6.3 (medium) · published 2026-11-13

n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.

Weakness: CWE-522

Source: NVD CVE-2026-126388

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh
• https://www.vulncheck.com/advisories/n8n-before-2.46.1-credential-leak-via-cross-origin-redirects-in-nodes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.