{"id":"GHSA-jmcg-c7p5-q69g","kind":"vulnerability","aliases":["GHSA-jmcg-c7p5-q69g"],"related":[],"title":"NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments","description":"## Impact\n\nWhen the NocoDB node reads rows with \"Download Attachments\" enabled, it takes the attachment URL directly from the record content and fetches it using the configured NocoDB credential. The target host is never compared against the credential's own host, so any party who can write to an attachment cell in a NocoDB base can cause the credential's API token to be sent to a host of their choosing when the workflow next executes.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Disable the \"Download Attachments\" option on all active NocoDB nodes until the instance is patched.\n- Audit NocoDB base memberships and remove editor access from any users who are not fully trusted.\n- Rotate any NocoDB API tokens used by affected workflows and audit recent execution logs for unexpected outbound requests.\n- Enable SSRF protection by setting `N8N_SSRF_PROTECTION_ENABLED=true`.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"When the n8n NocoDB node downloads attachments, it fetches the URL stored in the record without checking it against the NocoDB host, so the NocoDB API token is sent to whatever host the URL names. Anyone who can edit an attachment cell in a NocoDB base can make the token go to a host they control when the workflow runs.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.89"],"affected":"< 1.123.89","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["n8n","nocodb","package","self-hosted","workflow-automation"],"not_affected_if":["attachments-download-disabled","fixed-version","no-nocodb-node"],"how_to_check":"- Check the n8n version with `n8n --version` and compare it with the fixed versions below.\n- Look for NocoDB nodes with \"Download Attachments\" turned on in your workflows.\n- Review who has editor access to NocoDB bases that feed those workflows.","fix":"- n8n `1.123.89` on the 1.x line\n- n8n `2.45.5` on the 2.45 line\n- n8n `2.46.1` on the 2.46 line\n- n8n `3.0.1` on the 3.x line","status":"open","published_at":"2026-10-28T08:49:08+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:55:01+00:00","updated_at":"2026-11-09T22:55:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:55:01Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.89` on the 1.x line\n- n8n `2.45.5` on the 2.45 line\n- n8n `2.46.1` on the 2.46 line\n- n8n `3.0.1` on the 3.x line","reach":"network","title":"n8n NocoDB node leaks API token to attacker-chosen attachment hosts","impact":"medium","summary":"When the n8n NocoDB node downloads attachments, it fetches the URL stored in the record without checking it against the NocoDB host, so the NocoDB API token is sent to whatever host the URL names. Anyone who can edit an attachment cell in a NocoDB base can make the token go to a host they control when the workflow runs.","audience":"developers","category":"package","nicknames":[],"who_cares":["n8n","nocodb","self-hosted","workflow-automation"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"NocoDB API token is sent to an attacker-chosen host","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` and compare it with the fixed versions below.\n- Look for NocoDB nodes with \"Download Attachments\" turned on in your workflows.\n- Review who has editor access to NocoDB bases that feed those workflows.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-nocodb-node","attachments-download-disabled","fixed-version"],"who_is_affected":"Teams that run n8n with the NocoDB node and \"Download Attachments\" enabled are exposed, and the risk grows with the number of people who can edit NocoDB attachment cells. Instances without the NocoDB node, or with attachment download turned off, are not affected by this flaw. The advisory's workarounds are to disable that option, limit editor access, rotate tokens, and set `N8N_SSRF_PROTECTION_ENABLED=true`, but it says these are short-term only.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000861,"input_tokens":5057,"output_tokens":710,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'1.123.89':183C '2.45.5':184C '2.46.1':185C '3.0.1':187C 'access':219C,247C 'activ':232C 'administr':209C 'affect':263C 'anyon':73B 'api':5A,63B,158C,259C 'attach':14A,44B,78B,107C,112C,147C,228C 'attack':9A 'attacker-chosen':8A 'audit':240C,266C 'autom':37B 'base':83B,152C,242C 'c7p5':18A,23A 'caus':154C 'cell':79B,148C 'check':54B 'choos':168C 'chosen':10A 'compar':132C 'configur':124C 'consid':211C 'content':118C 'control':93B 'credenti':126C,135C,156C 'direct':114C 'disabl':225C 'download':13A,43B,106C,227C 'edit':76B 'editor':246C 'enabl':108C,274C,282C 'execut':173C,268C 'fetch':46B,120C 'fix':179C 'follow':213C 'fulli':221C,254C,288C 'ghsa':16A,21A 'ghsa-jmcg-c7p5-q69g':15A,20A 'go':88B 'host':11A,34B,59B,69B,91B,129C,138C,165C 'immedi':207C 'impact':98C 'instanc':218C,237C 'issu':176C 'jmcg':17A,22A 'later':197C 'log':269C 'make':85B 'measur':302C 'membership':243C 'mitig':215C,301C 'n8n':25A,26A,27A,28A,29B,40B,181C,217C,279C 'name':72B 'never':131C 'next':172C 'nocodb':1A,30B,41B,58B,62B,82B,101C,125C,151C,233C,241C,258C 'node':2A,42B,102C,234C 'one':192C 'option':229C 'outbound':272C 'packag':31B 'parti':141C 'patch':174C,239C 'possibl':208C 'protect':276C,281C 'q69g':19A,24A 'read':103C 'recent':267C 'record':52B,117C 'remedi':199C,289C 'remov':245C 'request':273C 'restrict':216C 'risk':291C 'rotat':256C 'row':104C 'run':97B 'self':33B 'self-host':32B 'send':3A 'sent':66B,162C 'set':278C 'short':299C 'short-term':298C 'ssrf':275C,280C 'store':49B 'take':110C 'target':128C 'temporari':214C 'term':300C 'token':6A,64B,87B,159C,260C 'true':283C 'trust':222C,255C 'unexpect':271C 'upgrad':190C,204C 'url':48B,71B,113C 'use':122C,261C,296C 'user':188C,223C,250C 'version':182C,195C 'vulner':201C 'whatev':68B 'without':53B 'workaround':202C,285C 'workflow':36B,96B,171C,264C 'workflow-autom':35B 'write':144C","nicknames":[],"mitigations":[],"who_affected":"Teams that run n8n with the NocoDB node and \"Download Attachments\" enabled are exposed, and the risk grows with the number of people who can edit NocoDB attachment cells. Instances without the NocoDB node, or with attachment download turned off, are not affected by this flaw. The advisory's workarounds are to disable that option, limit editor access, rotate tokens, and set `N8N_SSRF_PROTECTION_ENABLED=true`, but it says these are short-term only.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["medium","n8n","nocodb","npm","package","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'api':5A 'attach':14A 'attack':9A 'attacker-chosen':8A 'c7p5':18A,23A 'chosen':10A 'download':13A 'ghsa':16A,21A 'ghsa-jmcg-c7p5-q69g':15A,20A 'host':11A 'jmcg':17A,22A 'n8n':25A,26A,27A,28A 'nocodb':1A 'node':2A 'q69g':19A,24A 'send':3A 'token':6A","search_b":"'anyon':73B 'api':63B 'attach':44B,78B 'autom':37B 'base':83B 'cell':79B 'check':54B 'control':93B 'download':43B 'edit':76B 'fetch':46B 'go':88B 'host':34B,59B,69B,91B 'make':85B 'n8n':29B,40B 'name':72B 'nocodb':30B,41B,58B,62B,82B 'node':42B 'packag':31B 'record':52B 'run':97B 'self':33B 'self-host':32B 'sent':66B 'store':49B 'token':64B,87B 'url':48B,71B 'whatev':68B 'without':53B 'workflow':36B,96B 'workflow-autom':35B","search_c":"'1.123.89':183C '2.45.5':184C '2.46.1':185C '3.0.1':187C 'access':219C,247C 'activ':232C 'administr':209C 'affect':263C 'api':158C,259C 'attach':107C,112C,147C,228C 'audit':240C,266C 'base':152C,242C 'caus':154C 'cell':148C 'choos':168C 'compar':132C 'configur':124C 'consid':211C 'content':118C 'credenti':126C,135C,156C 'direct':114C 'disabl':225C 'download':106C,227C 'editor':246C 'enabl':108C,274C,282C 'execut':173C,268C 'fetch':120C 'fix':179C 'follow':213C 'fulli':221C,254C,288C 'host':129C,138C,165C 'immedi':207C 'impact':98C 'instanc':218C,237C 'issu':176C 'later':197C 'log':269C 'measur':302C 'membership':243C 'mitig':215C,301C 'n8n':181C,217C,279C 'never':131C 'next':172C 'nocodb':101C,125C,151C,233C,241C,258C 'node':102C,234C 'one':192C 'option':229C 'outbound':272C 'parti':141C 'patch':174C,239C 'possibl':208C 'protect':276C,281C 'read':103C 'recent':267C 'record':117C 'remedi':199C,289C 'remov':245C 'request':273C 'restrict':216C 'risk':291C 'rotat':256C 'row':104C 'sent':162C 'set':278C 'short':299C 'short-term':298C 'ssrf':275C,280C 'take':110C 'target':128C 'temporari':214C 'term':300C 'token':159C,260C 'true':283C 'trust':222C,255C 'unexpect':271C 'upgrad':190C,204C 'url':113C 'use':122C,261C,296C 'user':188C,223C,250C 'version':182C,195C 'vulner':201C 'workaround':202C,285C 'workflow':171C,264C 'write':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:49:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-jmcg-c7p5-q69g","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g","severity":"medium","published_at":"2026-10-28T08:49:08+00:00","modified_at":"2026-10-28T08:49:08+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110627,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}