---
id: "CVE-2026-126390"
page: "https://infrastack.ai/live/CVE-2026-126390"
kind: "vulnerability"
aliases: ["CVE-2026-126390"]
title: "n8n: NocoDB node leaks API token to attacker-chosen hosts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "n8n", "nocodb", "self-hosted"]
not_affected_if: ["download-attachments-disabled", "no-nocodb-node", "version-1.123.89-or-later"]
published_at: "2026-11-13T10:17:42+00:00"
first_seen_at: "2026-11-13T10:47:18+00:00"
updated_at: "2026-11-13T10:55:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126390", "first_seen_at": "2026-11-13T10:47:18+00:00"}]
exploit_sources: []
---

# n8n: NocoDB node leaks API token to attacker-chosen hosts

Link for people: https://infrastack.ai/live/CVE-2026-126390 (this .md is for agents)

The n8n NocoDB node sends the configured NocoDB API token to any host named in an attachment URL when Download Attachments runs. An attacker with write access to a NocoDB attachment cell can capture that token by inserting a URL pointing to their own server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the n8n version with `n8n --version`; versions below `1.123.89` are affected.
- Look for workflows that use the NocoDB node with Download Attachments enabled.
- Check who has write access to NocoDB attachment cells.

## Fix

- n8n: move to `1.123.89` or later.

## Timeline

- 2026-11-13T10:47:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126390

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/n8n-before-1.123.89-nocodb-node-api-token-leak-via-attachment-download

## From the sources

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_