n8n is an open‑source workflow automation platform. Until versions 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permissions to create or modify workflows and with access to a SecurityScorecard credential that has a limited set of allowed domains could configure the SecurityScorecard node’s report‑download operation to target an attacker‑controlled URL. The node automatically appends the SecurityScorecard API token to the outbound request, sending the credential to the malicious host and bypassing the configured domain restrictions. This results in exfiltration of the API token, allowing the attacker to authenticate with SecurityScorecard services and potentially access or manipulate sensitive information.

The vulnerability affects installations of n8n-io:n8n prior to versions 1.123.55, 2.25.7, and 2.26.1. Any instance running a vulnerable version and employing the SecurityScorecard node is at risk.

The CVSS score of 7.1 reflects a moderate to high risk given the potential for credential compromise. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires a user with workflow edit permissions and legitimate access to a SecurityScorecard credential, making it a privilege‑based attack vector rather than remote unauthenticated exploitation. While the prerequisite access limits the attack surface, the impact of the token leak is significant because the credential can be used to reach external SecurityScorecard services.