High severity7.7NVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026

CVE-2026-103246

Description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.

Affected products

N8n Io/N8nllm-fuzzy
Range: <2.39.6, 2.40.0 < 2.40.1

Patches

Vulnerability mechanics

References

github.com/n8n-io/n8n/security/advisories/GHSA-9rhv-fhr8-7q5rnvd
www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-credential-disclosure-via-node-tool-introspectionnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000