CVE-2026-56348

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.20.0

Description An issue in the "POST /rest/dynamic-node-parameters/options" endpoint allows authenticated users with credential access to bypass Allowed HTTP Request Domains restrictions. This enables an attacker to force the server to issue HTTP requests containing credentials to unauthorized hosts, leading to the exfiltration of sensitive authentication data.

Recommendations Update to version 2.20.0 or later. Restrict n8n access to fully trusted users only. Limit credential sharing to users who genuinely require access to those credentials.