{"schema":"threatline.record/2","record":{"id":"GHSA-prmc-fg87-r4gh","aliases":["GHSA-prmc-fg87-r4gh"],"summary":"Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects","details":"## Impact\n\nWhen an HTTP request made by a credential-authenticated node followed a redirect to a different origin, n8n re-attached the `Authorization` header and basic auth credentials to the redirected request. The internal helper that builds the redirect configuration defaulted `sendCredentialsOnCrossOriginRedirect` to `true`. The HTTP Request node v4.4 opted out of this default, but other credential-using nodes did not. Where a workflow makes authenticated HTTP requests and the redirect target can be influenced by untrusted data, such as an expression-fed URL or a redirect issued by an attacker-controlled endpoint, the stored credential could be forwarded to an unintended destination.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.46.1, 2.45.5 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit active workflows that use credential-authenticated HTTP requests and ensure that request URLs and any data that could influence redirect targets do not incorporate untrusted external input.\n- Apply network-level controls to restrict outbound HTTP requests from the n8n process to known, trusted destinations.\n- Enable SSRF protection by setting `N8N_SSRF_PROTECTION_ENABLED=true` to reduce the risk of attacker-influenced outbound requests.\n- Rotate any credentials used by workflows that may have been exposed to untrusted redirect targets.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","source_modified_at":"2026-10-28T08:49:03Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.46.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","source_modified_at":"2026-10-28T08:49:03Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.45.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","source_modified_at":"2026-10-28T08:49:03Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 3.0.1"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T08:49:03Z","modified_at":"2026-10-28T08:49:03Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T08:49:03Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T08:49:03Z","content_hash":"7092e85bd56b7312c1886ca7d6e3a56d987658cda29e177f738813f5e3849163"}}