CVE-2026-103257CWE-22path-traversal

CVE-2026-103257

High · published October 1, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
8.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-01T15:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-89p4-6h98-c7xm · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-via-n8n-node · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:42Z
    n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
    cvelistv5