CVE-2026-25631

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Improper Input Validation pada n8n. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. This issue is fixed in version 1.121.0 and later.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h advisory pihak ketiga