High severity7.1NVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026

CVE-2026-103256

Description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

N8n Io/N8nllm-fuzzy
Range: <2.39.6, 2.40.0 to <2.40.1

Patches

Vulnerability mechanics

References

github.com/n8n-io/n8n/security/advisories/GHSA-gx6g-2hm7-c4xfnvd
www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-credentials-leak-via-preauthentication-hooknvd

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000