CVE-2026-126390
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled.