7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54304

CVE-2026-54304: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attached the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host bypassing credential configured limitations and exfiltrating. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54304

CVE-2026-54304:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.123.55	1.123.55
n8n	npm	>= 2.26.0, < 2.26.1	2.26.1
n8n	npm	>= 2.0.0-rc.0, < 2.25.7	2.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the SecurityScorecard.node.ts file, within the execute method. Specifically, the 'download' operation for the 'report' resource is vulnerable. A user can provide a malicious URL through the 'url' parameter. This URL is then used by the scorecardApiRequest function in GenericFunctions.ts to make an HTTP request. The scorecardApiRequest function attaches the SecurityScorecard API token to the Authorization header of this request. Because the URL is not properly validated, an attacker can provide a URL to a server they control and exfiltrate the API token. The resolveReportDownloadUrl function attempts to validate the URL, but this validation is insufficient and can be bypassed. The primary vulnerable function is SecurityScorecard.execute, as it orchestrates the attack, and the scorecardApiRequest function is the sink where the credential leak occurs.

Vulnerable functions

SecurityScorecard.execute

packages/nodes-base/nodes/SecurityScorecard/SecurityScorecard.node.ts

An authenticated user with permission to create or modify workflows can configure the SecurityScorecard node's 'report download' operation to target an attacker-controlled URL. The node attaches the SecurityScorecard API token to the outbound request, causing the credential to be sent to the attacker-controlled host, bypassing any credential-configured limitations and exfiltrating the token.

scorecardApiRequest

packages/nodes-base/nodes/SecurityScorecard/GenericFunctions.ts

This function constructs and sends an HTTP request. When called from the `SecurityScorecard.execute` function with a malicious URL, it attaches the API token to the request, sending it to the attacker's server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.