CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
Attackers can bypass authorization in the credential test endpoint to exfiltrate sensitive project variables by specifying arbitrary project IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103252?
CVE-2026-103252 is a high-severity missing authorization vulnerability in n8n-io n8n, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
Weakness: CWE-639
Which versions are affected by CVE-2026-103252?
How do I fix CVE-2026-103252?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-103252 being exploited?
There is no known exploitation of CVE-2026-103252 in the wild and no public exploit code.
Sources
Also known as GHSA-7gvh-q9w3-wqqx, GHSA-r56q-6p4g-65g7, MINI-m852-9p3m-5h44.