CVE-2026-103251CWE-862broken-access-control

CVE-2026-103251

High · published October 1, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.5 · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00201 · 9.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-01T15:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-fmmv-p585-7c8x · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-package-install-validation-bypass-via-pubsub · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:41Z
    n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
    cvelistv5