CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
Attackers can exploit path traversal in n8n nodes to access unauthorized workflows, executions, and credential secrets via crafted resource IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103257?
CVE-2026-103257 is a high-severity path traversal vulnerability in n8n-io n8n, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
Weakness: CWE-22
Which versions are affected by CVE-2026-103257?
How do I fix CVE-2026-103257?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-103257 being exploited?
There is no known exploitation of CVE-2026-103257 in the wild and no public exploit code.
Sources
Also known as GHSA-89p4-6h98-c7xm, GHSA-cfpw-gmwr-v9wc, MINI-wx4r-4g3m-56vx.