CVE-2026-103252: n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are n8n releases before 1.123.80, versions from 2.0.0 through before 2.39.6, and versions from 2.40.0 through before 2.40.1.
What access does an attacker need to exploit this issue?
The attacker needs privileges to invoke the credential test endpoint. They can provide an arbitrary project ID in the request body, and no user interaction is required.
What information can be exposed?
Sensitive project-scoped variables may be interpolated into credential test requests. An attacker can direct those requests to an attacker-controlled host to exfiltrate the resolved values.
What is the remediation?
Upgrade to n8n 1.123.80, 2.39.6, or 2.40.1, as appropriate for the deployed release line.