High severity7.7NVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026

CVE-2026-103257

Description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

Affected products

N8n Io/N8nllm-fuzzy
Range: <1.123.80, 2.0.0-<2.39.6, 2.40.0-<2.40.1

Patches

Vulnerability mechanics

References

github.com/n8n-io/n8n/security/advisories/GHSA-89p4-6h98-c7xmnvd
www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-via-n8n-nodenvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000