PatchSiren cyber security CVE debrief

CVE-2026-56348 n8n CVE debrief

CVE-2026-56348 is a medium-severity credential exfiltration vulnerability in n8n before 2.20.0. The vulnerability exists in the POST /rest/dynamic-node-parameters/options endpoint and allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data. This vulnerability has a CVSS score of 5.3 and is considered medium severity. The CVE was published on June 22, 2026, and modified on June 24, 2026. n8n has released a patch for this vulnerability in version 2.20.0.

Vendor: n8n
Product: Unknown
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-22
Original CVE updated: 2026-06-24
Advisory published: 2026-06-22
Advisory updated: 2026-06-24

Who should care

Security teams and administrators responsible for n8n installations should be aware of this vulnerability. Authenticated users with credential access are at risk of being exploited. Organizations using n8n versions prior to 2.20.0 should prioritize patching to prevent potential credential exfiltration.

Technical summary

The vulnerability exists in the POST /rest/dynamic-node-parameters/options endpoint of n8n before 2.20.0. Authenticated users can bypass Allowed HTTP Request Domains restrictions, allowing them to cause the n8n server to issue HTTP requests with credentials to unauthorized hosts. This can lead to the exfiltration of sensitive authentication data. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Patching to version 2.20.0 or later is strongly recommended. In the meantime, defenders should monitor for suspicious activity and restrict access to the affected endpoint.

Recommended defensive actions

Patch n8n to version 2.20.0 or later
Monitor for suspicious activity on the POST /rest/dynamic-node-parameters/options endpoint
Restrict access to the affected endpoint
Review and update Allowed HTTP Request Domains restrictions
Implement additional monitoring for potential credential exfiltration

Evidence notes

The CVE-2026-56348 vulnerability was published on June 22, 2026, and modified on June 24, 2026. The vulnerability affects n8n versions prior to 2.20.0. The CVSS score for this vulnerability is 5.3, and it is considered medium severity. The CWE for this vulnerability is CWE-918.

Sources and references

Verified primary and authoritative sources

CVE-2026-56348 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-56348

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-56348 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56348

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46

[email protected] - Vendor Advisory
Mitigation or vendor reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint

[email protected] - Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.