Summary
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
References
Related vulnerabilities
All Supply chain →- CRITICALGHSA-X223-P2GF-V735
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
- MEDIUMGHSA-FG94-H982-F3MM
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
- HIGHGHSA-RJXQ-QQHF-8HWH
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
- MEDIUMGHSA-4R4W-2WGP-W7CJ
Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
- HIGHGHSA-VJQM-6GCC-62CR
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
- HIGHGHSA-VRHC-3FR6-PC3C
Open WebUI: Forged chat-file link allows cross-user file read and deletion