CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
Attackers can steal session tokens from collaborators via malicious resolver registration, leading to unauthorized credential access in n8n.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-103259?
CVE-2026-103259 is a high-severity vulnerability in n8n-io n8n, published on 1 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.
Weakness: CWE-863
Which versions are affected by CVE-2026-103259?
How do I fix CVE-2026-103259?
Upgrade to a fixed version.
Is CVE-2026-103259 being exploited?
There is no known exploitation of CVE-2026-103259 in the wild and no public exploit code.
Sources
Also known as GHSA-qrhv-fqjc-jcmq, GHSA-rx55-8qhx-4hwx, MINI-ppcv-ppc7-5r33.