CVE-2026-103247 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The n8n automation platform, prior to version 1.123.80, contains a critical credential tampering vulnerability that undermines the integrity of workflow security mechanisms. This flaw specifically targets the internal logic used to validate node identities within shared workflows. The core technical issue stems from an insufficient validation process where duplicate node identifiers are not properly sanitized or rejected during the parsing and execution phases. In n8n, each component in a workflow is assigned a unique identifier to ensure that configuration data, including sensitive credentials, is correctly mapped to its intended operational context. However, when multiple nodes share identical IDs due to improper handling of duplicates, the system fails to distinguish between legitimate user configurations and maliciously injected structures. This breakdown in identity verification allows an attacker with editor access to manipulate the workflow structure without triggering standard security alerts or validation errors that would normally prevent such modifications.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of sensitive authentication data stored within n8n workflows. Attackers can exploit the mismatch between node IDs and names to bypass credential tamper guards designed to detect unauthorized changes. By introducing duplicate nodes with conflicting identifiers, an attacker can effectively retain access to victim credentials while simultaneously redirecting secret values to infrastructure controlled by the adversary. This capability enables a sophisticated form of data exfiltration where sensitive tokens, API keys, or database passwords are not merely copied but actively rerouted. Consequently, any downstream services that rely on these redirected secrets may authenticate against attacker-controlled endpoints, leading to unauthorized access, data theft, or further compromise of connected systems. The ability to retain victim credentials also suggests potential for persistent backdoor access within the automation pipeline, allowing long-term surveillance or manipulation of automated processes.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the redirected secrets are subsequently used in an unauthorized manner. It also relates to CWE-613 Insufficient Session Expiration when considering the persistence of access through retained credentials. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1505.003 Server Software Component: Web Shell or more accurately T1589.002 Gather Victim Identity Information: Credentials for initial foothold establishment and T1078 Valid Accounts if the attacker uses stolen credentials to maintain access. The specific mechanism of redirecting secrets is akin to credential stuffing or man-in-the-middle attacks within internal service communications, falling under lateral movement techniques such as T1550 Use Alternate Authentication Material.
Mitigation strategies must prioritize immediate version upgrades and rigorous workflow auditing. Organizations running n8n should upgrade to version 1.123.80 or later immediately, as this release addresses the duplicate node ID handling logic that permits tampering. In addition to upgrading, administrators should enforce strict access controls on shared workflows, limiting editor privileges to trusted personnel only. Implementing multi-factor authentication for all n8n accounts adds a layer of defense against credential theft resulting from such exploits. Furthermore, regular audits of workflow configurations can help identify anomalies in node structures or unexpected redirections of secret values. Security teams should also monitor logs for unusual patterns in API calls or data transfers that might indicate active exploitation of this vulnerability before patches are applied.