CVE-2026-103257: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are n8n releases before 1.123.80, versions from 2.0.0 before 2.39.6, and versions from 2.40.0 before 2.40.1.
What does an attacker need to exploit this issue?
The attacker can exploit the issue remotely without prior privileges or user interaction, but the exposed data and actions are limited to the scope of the API key used by the vulnerable n8n node.
What resources could be exposed?
A malicious resource ID can redirect API calls to unintended resources. This can permit unauthorized access to workflows, executions, and credential secrets that are within the applicable API key's scope.
What is the remediation?
Upgrade to n8n 1.123.80, 2.39.6, or 2.40.1, as applicable to the release line in use.