CVE-2026-103257 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The identified security flaw resides within the core functionality of the n8n automation platform across multiple version branches, specifically affecting versions prior to 1.123.80 in the legacy branch, as well as versions from 2.0.0 up to but not including 2.39.6 and from 2.40.0 up to but not including 2.40.1. This vulnerability is classified as a path traversal issue stemming from insufficient validation of resource identifiers passed by the client during API interactions. In secure software design, input data such as file paths or resource IDs must be strictly sanitized to ensure they reference only intended and authorized targets within the application's context. The failure in n8n allows an attacker to manipulate these identifiers using standard traversal sequences or encoded variants thereof, effectively bypassing access controls that rely on simple string matching rather than robust canonicalization checks.
From a technical perspective, this flaw enables unauthorized redirection of API calls to resources outside their intended scope. When the application processes a request containing a maliciously crafted resource ID, it fails to properly resolve and validate the target location against an allowlist or secure base path. This lack of validation permits the attacker to traverse directory structures or access internal endpoints that should remain isolated from external manipulation. The consequence is a significant breach in data integrity and confidentiality, as the application proceeds with operations on resources that were not explicitly authorized for the current session or API key context.
The operational impact of this vulnerability is severe due to the sensitive nature of the data accessible through n8n workflows. An attacker exploiting this flaw can gain unauthorized access to critical workflow definitions, execution histories, and most critically, stored credential secrets. Since n8n serves as a central hub for integrating various services via API keys and tokens, compromising these credentials allows an adversary to pivot into downstream systems connected by the affected automation flows. This could lead to data exfiltration, manipulation of business logic through altered workflows, or further compromise of integrated third-party services such as cloud storage accounts, database connections, or communication platforms. The scope of damage is directly tied to the permissions associated with the compromised API key, meaning that keys with elevated privileges can result in widespread organizational impact.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-749 Exposed Dangerous Method or Function. In terms of tactical classification under the MITRE ATT&CK framework, this behavior corresponds to T1083 File and Directory Discovery as well as potential lateral movement if credential theft leads to access in other systems. The exploitation technique relies on input manipulation rather than complex buffer overflows or injection attacks, making it relatively straightforward for automated scanning tools or manual testers to identify and exploit if the underlying code remains unpatched.
To mitigate this risk, organizations running affected versions of n8n must upgrade immediately to version 1.123.80 or later in the legacy track, or version 2.39.6 or later including patch release 2.40.1 for newer deployments. The vendor has addressed the input validation logic to ensure that resource identifiers are properly canonicalized and checked against allowed paths before processing. Additionally, administrators should enforce strict least-privilege principles on API keys used by n8n instances, ensuring that automation accounts do not possess broader permissions than necessary for their specific tasks. Regular security audits of workflow configurations and credential storage practices further reduce the blast radius in case future vulnerabilities are discovered. Monitoring logs for unusual patterns in resource ID parameters can also aid in early detection of exploitation attempts before significant damage occurs.