n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
CVE-2026-103252
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103252
n8n
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "n8n-io",
"product": "n8n",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.123.80",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.39.6",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.40.0",
"lessThan": "2.40.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/n8n",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-103252
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #5179 · Revision 1
- Added to Heist Feed
- Publisher date