high7.7
CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection.
Impact
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
Affected products
| Product | Affected versions |
|---|---|
| N8n | before 2.39.6 |
| 2.40.0 | before 2.40.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.