{"id":"GHSA-prmc-fg87-r4gh","kind":"vulnerability","aliases":["GHSA-prmc-fg87-r4gh"],"related":[],"title":"Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects","description":"## Impact\n\nWhen an HTTP request made by a credential-authenticated node followed a redirect to a different origin, n8n re-attached the `Authorization` header and basic auth credentials to the redirected request. The internal helper that builds the redirect configuration defaulted `sendCredentialsOnCrossOriginRedirect` to `true`. The HTTP Request node v4.4 opted out of this default, but other credential-using nodes did not. Where a workflow makes authenticated HTTP requests and the redirect target can be influenced by untrusted data, such as an expression-fed URL or a redirect issued by an attacker-controlled endpoint, the stored credential could be forwarded to an unintended destination.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.46.1, 2.45.5 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit active workflows that use credential-authenticated HTTP requests and ensure that request URLs and any data that could influence redirect targets do not incorporate untrusted external input.\n- Apply network-level controls to restrict outbound HTTP requests from the n8n process to known, trusted destinations.\n- Enable SSRF protection by setting `N8N_SSRF_PROTECTION_ENABLED=true` to reduce the risk of attacker-influenced outbound requests.\n- Rotate any credentials used by workflows that may have been exposed to untrusted redirect targets.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n re-sent the Authorization header and basic auth credentials to a different origin when an authenticated HTTP request was redirected there. An attacker who can steer a redirect target, through an expression-fed URL or a malicious endpoint, can collect the stored credential.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","http-request","n8n","self-hosted","workflows"],"not_affected_if":["default-config-no-untrusted-urls","trusted-users-only"],"how_to_check":"- Check the installed n8n version with `n8n --version` or the `n8n` entry in `package.json`; versions below `2.45.5`, `2.46.1` or `3.0.1` are affected depending on the release line\n- Look for workflows that use credential-authenticated nodes (other than HTTP Request v4.4) with URLs built from untrusted input","fix":"- n8n `2.45.5` on the 2.45 line\n- n8n `2.46.1` on the 2.46 line\n- n8n `3.0.1` on the 3.x line","status":"open","published_at":"2026-10-28T08:49:03+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:55:01+00:00","updated_at":"2026-11-09T22:55:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:55:01Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.45.5` on the 2.45 line\n- n8n `2.46.1` on the 2.46 line\n- n8n `3.0.1` on the 3.x line","reach":"network","title":"n8n: credential nodes leak auth headers on cross-origin redirects","impact":"medium","summary":"n8n re-sent the Authorization header and basic auth credentials to a different origin when an authenticated HTTP request was redirected there. An attacker who can steer a redirect target, through an expression-fed URL or a malicious endpoint, can collect the stored credential.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","workflows","http-request"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"stored API credentials forwarded to an attacker-chosen destination","analyst_note":"","how_to_check":"- Check the installed n8n version with `n8n --version` or the `n8n` entry in `package.json`; versions below `2.45.5`, `2.46.1` or `3.0.1` are affected depending on the release line\n- Look for workflows that use credential-authenticated nodes (other than HTTP Request v4.4) with URLs built from untrusted input","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config-no-untrusted-urls","trusted-users-only"],"who_is_affected":"Self-hosted or managed n8n instances where workflows make credential-authenticated HTTP requests to URLs that can be influenced by untrusted data or by an attacker-controlled endpoint. The HTTP Request node v4.4 was not affected by the default, so workflows that use only that node are less exposed. Instances with only fully trusted users and fixed destinations carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000843,"input_tokens":5154,"output_tokens":656,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.45.5':201C '2.46.1':200C 'access':235C 'activ':242C 'administr':225C 'ai':27B 'ai-tool':26B 'appli':270C 'attach':105C 'attack':61B,178C,304C 'attacker-control':177C 'attacker-influenc':303C 'audit':241C 'auth':46B,111C 'authent':6A,54B,93C,151C,248C 'author':42B,107C 'basic':45B,110C 'build':121C 'collect':79B 'configur':124C 'consid':227C 'control':179C,274C 'could':184C,260C 'credenti':2A,47B,82B,92C,112C,142C,183C,247C,310C 'credential-authent':91C,246C 'credential-us':1A,141C 'cross':10A 'cross-origin':9A 'data':163C,258C 'default':125C,138C 'destin':190C,287C 'differ':50B,100C 'enabl':288C,296C 'endpoint':77B,180C 'ensur':252C 'expos':318C 'express':71B,168C 'expression-f':70B,167C 'extern':268C 'fed':72B,169C 'fg87':16A,21A 'fix':196C 'follow':95C,229C 'forward':5A,186C 'fulli':237C,327C 'ghsa':14A,19A 'ghsa-prmc-fg87-r4gh':13A,18A 'header':7A,43B,108C 'helper':119C 'host':35B 'http':30B,55B,86C,130C,152C,249C,278C 'http-request':29B 'immedi':223C 'impact':83C 'incorpor':266C 'influenc':160C,261C,305C 'input':269C 'instanc':234C 'intern':118C 'issu':174C,193C 'known':285C 'later':213C 'level':273C 'made':88C 'make':150C 'malici':76B 'may':315C 'measur':341C 'mitig':231C,340C 'n8n':23A,24A,25A,32B,37B,102C,198C,233C,282C,293C 'network':272C 'network-level':271C 'node':4A,94C,132C,144C 'one':208C 'opt':134C 'origin':11A,51B,101C 'outbound':277C,306C 'patch':191C 'possibl':224C 'prmc':15A,20A 'process':283C 'protect':290C,295C 'r4gh':17A,22A 're':39B,104C 're-attach':103C 're-sent':38B 'redirect':12A,58B,66B,97C,115C,123C,156C,173C,262C,321C 'reduc':299C 'remedi':215C,328C 'request':31B,56B,87C,116C,131C,153C,250C,254C,279C,307C 'restrict':232C,276C 'risk':301C,330C 'rotat':308C 'self':34B 'self-host':33B 'sendcredentialsoncrossoriginredirect':126C 'sent':40B 'set':292C 'short':338C 'short-term':337C 'ssrf':289C,294C 'steer':64B 'store':81B,182C 'target':67B,157C,263C,322C 'temporari':230C 'term':339C 'tool':28B 'true':128C,297C 'trust':238C,286C 'unintend':189C 'untrust':162C,267C,320C 'upgrad':206C,220C 'url':73B,170C,255C 'use':3A,143C,245C,311C,335C 'user':204C,239C 'v3.0.1':203C 'v4.4':133C 'version':199C,211C 'vulner':217C 'workaround':218C,324C 'workflow':36B,149C,243C,313C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed n8n instances where workflows make credential-authenticated HTTP requests to URLs that can be influenced by untrusted data or by an attacker-controlled endpoint. The HTTP Request node v4.4 was not affected by the default, so workflows that use only that node are less exposed. Instances with only fully trusted users and fixed destinations carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","httprequest","medium","n8n","npm","selfhosted","workflows"],"campaign_type":null,"search_a":"'authent':6A 'credenti':2A 'credential-us':1A 'cross':10A 'cross-origin':9A 'fg87':16A,21A 'forward':5A 'ghsa':14A,19A 'ghsa-prmc-fg87-r4gh':13A,18A 'header':7A 'n8n':23A,24A,25A 'node':4A 'origin':11A 'prmc':15A,20A 'r4gh':17A,22A 'redirect':12A 'use':3A","search_b":"'ai':27B 'ai-tool':26B 'attack':61B 'auth':46B 'authent':54B 'author':42B 'basic':45B 'collect':79B 'credenti':47B,82B 'differ':50B 'endpoint':77B 'express':71B 'expression-f':70B 'fed':72B 'header':43B 'host':35B 'http':30B,55B 'http-request':29B 'malici':76B 'n8n':32B,37B 'origin':51B 're':39B 're-sent':38B 'redirect':58B,66B 'request':31B,56B 'self':34B 'self-host':33B 'sent':40B 'steer':64B 'store':81B 'target':67B 'tool':28B 'url':73B 'workflow':36B","search_c":"'2.45.5':201C '2.46.1':200C 'access':235C 'activ':242C 'administr':225C 'appli':270C 'attach':105C 'attack':178C,304C 'attacker-control':177C 'attacker-influenc':303C 'audit':241C 'auth':111C 'authent':93C,151C,248C 'author':107C 'basic':110C 'build':121C 'configur':124C 'consid':227C 'control':179C,274C 'could':184C,260C 'credenti':92C,112C,142C,183C,247C,310C 'credential-authent':91C,246C 'credential-us':141C 'data':163C,258C 'default':125C,138C 'destin':190C,287C 'differ':100C 'enabl':288C,296C 'endpoint':180C 'ensur':252C 'expos':318C 'express':168C 'expression-f':167C 'extern':268C 'fed':169C 'fix':196C 'follow':95C,229C 'forward':186C 'fulli':237C,327C 'header':108C 'helper':119C 'http':86C,130C,152C,249C,278C 'immedi':223C 'impact':83C 'incorpor':266C 'influenc':160C,261C,305C 'input':269C 'instanc':234C 'intern':118C 'issu':174C,193C 'known':285C 'later':213C 'level':273C 'made':88C 'make':150C 'may':315C 'measur':341C 'mitig':231C,340C 'n8n':102C,198C,233C,282C,293C 'network':272C 'network-level':271C 'node':94C,132C,144C 'one':208C 'opt':134C 'origin':101C 'outbound':277C,306C 'patch':191C 'possibl':224C 'process':283C 'protect':290C,295C 're':104C 're-attach':103C 'redirect':97C,115C,123C,156C,173C,262C,321C 'reduc':299C 'remedi':215C,328C 'request':87C,116C,131C,153C,250C,254C,279C,307C 'restrict':232C,276C 'risk':301C,330C 'rotat':308C 'sendcredentialsoncrossoriginredirect':126C 'set':292C 'short':338C 'short-term':337C 'ssrf':289C,294C 'store':182C 'target':157C,263C,322C 'temporari':230C 'term':339C 'true':128C,297C 'trust':238C,286C 'unintend':189C 'untrust':162C,267C,320C 'upgrad':206C,220C 'url':170C,255C 'use':143C,245C,311C,335C 'user':204C,239C 'v3.0.1':203C 'v4.4':133C 'version':199C,211C 'vulner':217C 'workaround':218C,324C 'workflow':149C,243C,313C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:49:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-prmc-fg87-r4gh","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","severity":"medium","published_at":"2026-10-28T08:49:03+00:00","modified_at":"2026-10-28T08:49:03+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110628,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}