CVE-2026-54304 Overview
CVE-2026-54304 is a credential exposure vulnerability in n8n, an open source workflow automation platform. The flaw exists in the SecurityScorecard node's report download operation. An authenticated user with workflow modification rights and access to a SecurityScorecard credential can redirect outbound requests to an attacker-controlled URL. The node attaches the SecurityScorecard API token to the request, leaking the credential to the external host. This bypasses the credential's configured allowed-domains restriction. The issue is tracked under CWE-200: Exposure of Sensitive Information and is fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1.
Critical Impact
Authenticated workflow editors can exfiltrate SecurityScorecard API tokens to arbitrary external hosts, bypassing the credential's domain allowlist enforcement.
Affected Products
- n8n versions prior to 1.123.55
- n8n versions prior to 2.25.7
- n8n versions prior to 2.26.1
Discovery Timeline
- 2026-06-23 - CVE-2026-54304 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-54304
Vulnerability Analysis
The vulnerability resides in the SecurityScorecard node's report download operation within n8n. The node accepts a user-supplied URL for retrieving report data. It then performs the outbound HTTP request while attaching the configured SecurityScorecard API token as authentication. The node fails to validate the destination URL against the credential's allowed-domains list before sending the token. An authenticated attacker with permission to create or modify workflows can substitute the legitimate SecurityScorecard endpoint with an attacker-controlled host. The API token is transmitted directly to the malicious server, enabling credential theft. The EPSS score is 0.375% with a percentile of 29.29.
Root Cause
The root cause is missing validation of the request target against the credential's domain restriction policy. The node treats the user-supplied URL as authoritative and unconditionally attaches the bearer token. The allowed-domains configuration exists at the credential layer but is not enforced at the node's HTTP request layer.
Attack Vector
Exploitation requires an authenticated n8n user with workflow editing permissions and read access to a SecurityScorecard credential. The attacker configures a SecurityScorecard node with the report download operation. The attacker points the operation at a controlled URL such as https://attacker.example.com/collector. When the workflow executes, n8n issues the outbound request with the API token in the authorization header. The attacker captures the token from their server logs and uses it to access SecurityScorecard data outside n8n.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-rm2v-h48j-895m for vendor technical details.
Detection Methods for CVE-2026-54304
Indicators of Compromise
- Outbound HTTPS requests from n8n hosts to domains outside securityscorecard.io containing SecurityScorecard authorization headers.
- Workflow definitions referencing the SecurityScorecard node with non-standard URLs in the report download operation.
- Unexpected modifications to workflows by users with credential read access to SecurityScorecard.
Detection Strategies
- Audit n8n workflow JSON exports for SecurityScorecard nodes whose URL parameter does not match the official SecurityScorecard API base path.
- Review n8n execution logs for HTTP request errors or redirects originating from the SecurityScorecard node to unfamiliar destinations.
- Correlate SecurityScorecard API usage with the n8n server's outbound network connections to identify token use from unauthorized IP addresses.
Monitoring Recommendations
- Enable egress filtering on the n8n host and allowlist only known SecurityScorecard API endpoints for outbound traffic from workflow execution.
- Forward n8n audit logs and webhook execution telemetry to a SIEM for correlation against workflow change events.
- Rotate SecurityScorecard API tokens and monitor for usage from unexpected source addresses.
How to Mitigate CVE-2026-54304
Immediate Actions Required
- Upgrade n8n to version 1.123.55, 2.25.7, or 2.26.1 depending on your release track.
- Rotate all SecurityScorecard API tokens stored as credentials in n8n.
- Audit workflow change history for unauthorized SecurityScorecard node modifications since deployment.
- Restrict workflow creation and modification permissions to trusted users only.
Patch Information
The vendor released fixes in n8n 1.123.55, 2.25.7, and 2.26.1. The patched versions enforce the credential's allowed-domains restriction at the request layer in the SecurityScorecard node. See the n8n GitHub Security Advisory for complete remediation details.
Workarounds
- Temporarily remove the SecurityScorecard credential from n8n until upgrade is complete.
- Apply network-layer egress filtering on the n8n host to restrict outbound HTTP traffic to the legitimate SecurityScorecard API domain.
- Reduce the number of users with workflow:create and workflow:update roles in n8n's RBAC configuration.
# Verify n8n version after upgrade
n8n --version
# Example egress allowlist using iptables on the n8n host
iptables -A OUTPUT -p tcp --dport 443 -d api.securityscorecard.io -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
