PT-2026-146676
CVE-2026-126390
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
3.7
LowMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.
Found an issue in the description? Have something to add? Feel free to write us 👾