Credential Disclosure in n8n Products by n8n Technologies
CVE-2026-103246

8.3HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103246?

n8n versions prior to 2.39.6 and 2.40.1 (before 2.40.1) are susceptible to a vulnerability where the system does not validate credential ownership during inline agent node-tool introspection. This flaw allows attackers to exploit arbitrary credential IDs, leading to potential decryption and exfiltration of plaintext secrets to unauthorized hosts, creating significant security risks for users.

Affected Version(s)

n8n 0 < 2.39.6

n8n 2.40.0 < 2.40.1

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-9r...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-2.39.6-an...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

foxmiti
.