CVE-2026-103257
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a…
- Risk score
- 58/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.80, 2.39.6 or 2.40.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
- Remotely exploitable without logging in
References
Original description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
Last activity 1 Oct 2026. Patch Forecast updates every hour.