CVE-2026-25631

n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. This issue is fixed in version 1.121.0 and later.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*

History

17 Jun 2026, 10:24

Type	Values Removed	Values Added
Summary		(es) n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de la versión 1.121.0, existe una vulnerabilidad en la validación de dominio de credenciales del nodo de Solicitud HTTP que permitía a un atacante autenticado enviar solicitudes con credenciales a dominios no deseados, lo que podría llevar a la exfiltración de credenciales. Esto solo podría afectar a usuarios que tienen credenciales que utilizan patrones de dominio comodín (por ejemplo, *.example.com) en la configuración de 'Dominios permitidos'. Este problema está solucionado en la versión 1.121.0 y posteriores.

19 Feb 2026, 17:51

Type	Values Removed	Values Added
CPE		cpe:2.3:a:n8n:n8n::::::node.js::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
First Time		N8n n8n N8n
CWE		CWE-522
References	~~() https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h -~~	() https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h - Third Party Advisory

06 Feb 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-06 21:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25631

Mitre link : CVE-2026-25631

CVE.ORG link : CVE-2026-25631

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-20

Improper Input Validation

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-25631", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25631", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T21:06:21.488887Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.121.0"}]}]}], "published": "2026-02-06T21:16:18.230", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the \"Allowed domains\" setting. This issue is fixed in version 1.121.0 and later."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de la versi\u00f3n 1.121.0, existe una vulnerabilidad en la validaci\u00f3n de dominio de credenciales del nodo de Solicitud HTTP que permit\u00eda a un atacante autenticado enviar solicitudes con credenciales a dominios no deseados, lo que podr\u00eda llevar a la exfiltraci\u00f3n de credenciales. Esto solo podr\u00eda afectar a usuarios que tienen credenciales que utilizan patrones de dominio comod\u00edn (por ejemplo, *.example.com) en la configuraci\u00f3n de 'Dominios permitidos'. Este problema est\u00e1 solucionado en la versi\u00f3n 1.121.0 y posteriores."}], "lastModified": "2026-06-17T10:24:58.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "51C9C1AF-7118-42A5-A973-CA66FE251756", "versionEndExcluding": "1.121.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}