CVE-2026-54304High· 7.7▾ Twilightn8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.4%
An authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating.
The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
n8n-nodes-base.securityScorecard to the NODES_EXCLUDE environment variable.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
n8n < 1.123.55n8n >= 2.26.0, < 2.26.1n8n >= 2.0.0-rc.0, < 2.25.7Upgrade to a patched release:
n8n 1.123.55n8n 2.26.1n8n 2.25.7Connected by shared product, vendor, weakness, or advisory.
GHSA-2x35-3fw4-9jr4Highn8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
CVE-2026-59209Highn8n: Shared Credential Header Leak via HTTP Request Pagination Expression
CVE-2026-54305High· 9.9n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
CVE-2026-86083High· 8.8n8n is an open source workflow automation platform
CVE-2026-86084Medium· 5.5n8n is an open source workflow automation platform
CVE-2026-86085Medium· 4.9n8n is an open source workflow automation platform