EUVD-2026-125175

n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when...

CVE-2026-126390

The software n8n (versions before 1.123.89 ) is vulnerable to a credential leakage vulnerability within the NocoDB node . The root cause occurs when the node downloads attachments; if an attacker has write access to a NocoDB attachment cell, they can insert a URL pointing to a host they control. ...