CVE-2026-103252CWE-639

CVE-2026-103252

High · published October 1, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00273 · 18.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-01T15:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-7gvh-q9w3-wqqx · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-information-disclosure-via-credential-test-endpoint · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:41Z
    n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
    cvelistv5