{"id":"CVE-2026-126388","kind":"vulnerability","aliases":["CVE-2026-126388"],"related":[],"title":"n8n: cross-origin redirects leak stored workflow credentials to attacker endpoints","description":"n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint.","summary":"n8n before 2.46.1 forwards Authorization headers and basic auth credentials when a request is redirected to a different origin, because the sendCredentialsOnCrossOriginRedirect setting defaults to true. An attacker who controls a redirect target or an expression-fed URL in a credential-using node can capture the stored workflow credentials.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","n8n","self-hosted","workflow-automation"],"not_affected_if":["no-expression-fed-urls","version-2.46.1-or-later"],"how_to_check":"- Check the n8n version with `n8n --version` or the image tag; versions below `2.46.1` are in range.\n- Look for the `sendCredentialsOnCrossOriginRedirect` setting in the n8n environment or configuration and see whether it is still `true`.\n- Review workflows whose HTTP or credential-using nodes take URLs from expressions or external input.","fix":"- n8n: upgrade to `2.46.1` or later (per the sources' fixed version).","status":"open","published_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:55:23+00:00","updated_at":"2026-11-13T10:55:23+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:55:23Z","model":"claude-haiku-5-5","output":{"fix":"- n8n: upgrade to `2.46.1` or later (per the sources' fixed version).","reach":"internet","title":"n8n: cross-origin redirects leak stored workflow credentials to attacker endpoints","impact":"medium","summary":"n8n before 2.46.1 forwards Authorization headers and basic auth credentials when a request is redirected to a different origin, because the sendCredentialsOnCrossOriginRedirect setting defaults to true. An attacker who controls a redirect target or an expression-fed URL in a credential-using node can capture the stored workflow credentials.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","ai-agents","workflow-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Stored workflow credentials are sent to an attacker-controlled endpoint.","analyst_note":"Confirm the fixed version and the setting change from the maintainer advisory on github.com and the VulnCheck advisory, and check whether the default is changed in 2.46.1.","how_to_check":"- Check the n8n version with `n8n --version` or the image tag; versions below `2.46.1` are in range.\n- Look for the `sendCredentialsOnCrossOriginRedirect` setting in the n8n environment or configuration and see whether it is still `true`.\n- Review workflows whose HTTP or credential-using nodes take URLs from expressions or external input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2.46.1-or-later","no-expression-fed-urls"],"who_is_affected":"Teams that self-host n8n or run it in their own cloud, especially where workflows call URLs built from user input or external data with stored credentials attached. Instances on hosted n8n that already run `2.46.1` or later are not exposed by this issue, and workflows that never follow redirects to other hosts are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000824,"input_tokens":4623,"output_tokens":724,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126388':15A,18A '-2026':14A,17A '2.46.1':34B,85C 'agent':21B 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'attack':11A,59B,109C 'auth':40B,97C 'author':36B,93C 'autom':31B 'basic':39B,96C 'captur':78B,126C 'contain':86C 'control':61B,110C 'credenti':9A,41B,74B,82B,88C,98C,122C,129C 'credential-us':73B,121C 'cross':3A,101C 'cross-origin':2A,100C 'cve':13A,16A 'default':55B,106C 'differ':49B 'endpoint':12A,133C 'exposur':89C 'express':68B,117C 'expression-f':67B,116C 'fed':69B,118C 'forward':35B,92C 'header':37B,94C 'host':28B 'leak':6A 'n8n':1A,25B,32B,83C 'node':76B,124C 'origin':4A,50B,102C 'redirect':5A,46B,63B,103C,112C 'request':44B 'self':27B 'self-host':26B 'sendcredentialsoncrossoriginredirect':53B,105C 'sent':130C 'set':54B 'store':7A,80B,127C 'target':64B,113C 'tool':24B 'true':57B,108C 'url':70B,119C 'use':75B,123C 'vulner':90C 'workflow':8A,30B,81B,128C 'workflow-autom':29B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host n8n or run it in their own cloud, especially where workflows call URLs built from user input or external data with stored credentials attached. Instances on hosted n8n that already run `2.46.1` or later are not exposed by this issue, and workflows that never follow redirects to other hosts are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","medium","n8n","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'-126388':15A,18A '-2026':14A,17A 'attack':11A 'credenti':9A 'cross':3A 'cross-origin':2A 'cve':13A,16A 'endpoint':12A 'leak':6A 'n8n':1A 'origin':4A 'redirect':5A 'store':7A 'workflow':8A","search_b":"'2.46.1':34B 'agent':21B 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'attack':59B 'auth':40B 'author':36B 'autom':31B 'basic':39B 'captur':78B 'control':61B 'credenti':41B,74B,82B 'credential-us':73B 'default':55B 'differ':49B 'express':68B 'expression-f':67B 'fed':69B 'forward':35B 'header':37B 'host':28B 'n8n':25B,32B 'node':76B 'origin':50B 'redirect':46B,63B 'request':44B 'self':27B 'self-host':26B 'sendcredentialsoncrossoriginredirect':53B 'set':54B 'store':80B 'target':64B 'tool':24B 'true':57B 'url':70B 'use':75B 'workflow':30B,81B 'workflow-autom':29B","search_c":"'2.46.1':85C 'attack':109C 'auth':97C 'author':93C 'basic':96C 'captur':126C 'contain':86C 'control':110C 'credenti':88C,98C,122C,129C 'credential-us':121C 'cross':101C 'cross-origin':100C 'default':106C 'endpoint':133C 'exposur':89C 'express':117C 'expression-f':116C 'fed':118C 'forward':92C 'header':94C 'n8n':83C 'node':124C 'origin':102C 'redirect':103C,112C 'sendcredentialsoncrossoriginredirect':105C 'sent':130C 'store':127C 'target':113C 'true':108C 'url':119C 'use':123C 'vulner':90C 'workflow':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:49:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126388","severity":null,"published_at":"2026-11-13T10:17:42+00:00","modified_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110628,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:49:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145019,"url":"https://www.vulncheck.com/advisories/n8n-before-2.46.1-credential-leak-via-cross-origin-redirects-in-nodes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}