CVE-2026-103246: n8n Information Disclosure Vulnerability

CVE-2026-103246 Overview

CVE-2026-103246 is a broken access control vulnerability in n8n, an open-source workflow automation platform. The flaw affects n8n versions before 2.39.6 and 2.40.0 before 2.40.1. The platform fails to validate credential ownership during inline agent node-tool introspection. An authenticated attacker can reference arbitrary credential IDs belonging to other users, triggering decryption and exfiltration of plaintext secrets to attacker-controlled hosts. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Low-privileged users can decrypt and exfiltrate credentials owned by other n8n users, exposing API keys, OAuth tokens, and database passwords stored in the platform.

Affected Products

n8n versions prior to 2.39.6
n8n versions 2.40.0 before 2.40.1
Self-hosted and cloud deployments running the inline agent node-tool feature

Discovery Timeline

2026-10-01 - CVE-2026-103246 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103246

Vulnerability Analysis

n8n allows workflows to compose AI agent nodes that introspect other nodes as callable tools. During this introspection step, the platform resolves credential references attached to the referenced nodes. The vulnerable code path retrieves and decrypts the credential payload without confirming that the requesting user owns, or has been granted access to, the credential identified by the supplied ID.

Because credential IDs are opaque but enumerable, an attacker with permission to create a workflow can craft an inline agent definition that cites credential IDs they do not own. The server returns decrypted secret material in a form the attacker-defined tool can forward over the network. The result is cross-tenant disclosure of stored secrets without any ownership verification.

Root Cause

The root cause is a missing authorization check in the node-tool introspection handler. The handler treats the credential ID as a trusted lookup key and dereferences it against the decrypted credential store. No ACL evaluation ties the credential record to the acting user or project scope, matching the pattern described by CWE-639.

Attack Vector

Exploitation requires network access to the n8n API and a low-privileged authenticated session. The attacker enumerates or guesses credential IDs, then builds an agent workflow that invokes the target credential through node-tool introspection. The agent routes the resolved plaintext secret to an attacker-controlled HTTP endpoint. No user interaction is needed. See the GitHub Security Advisory GHSA-9rhv-fhr8-7q5r and the VulnCheck Advisory for n8n for additional detail.

No verified public exploit code is available for this CVE at the time of publication.

Detection Methods for CVE-2026-103246

Indicators of Compromise

Workflow or agent definitions created by non-admin users that reference credential IDs outside the user's owned project scope.
Outbound HTTP requests from n8n worker processes to unexpected or newly registered external hosts.
Credential decryption events in n8n audit logs that are not tied to the credential owner's identity.
Agent node executions that iterate rapidly over many distinct credential IDs in a short window.

Detection Strategies

Review n8n execution logs for inline agent nodes performing introspection against credentials the executing user did not create.
Correlate workflow authorship with credential ownership metadata and alert on mismatches.
Inspect network egress from the n8n host for connections to domains not previously observed from the application.

Monitoring Recommendations

Forward n8n audit and execution logs to a centralized logging platform and retain them for incident review.
Baseline normal outbound destinations for the n8n service and alert on new or low-reputation hosts.
Monitor for bulk credential access patterns and sudden spikes in agent node executions by a single user.

How to Mitigate CVE-2026-103246

Immediate Actions Required

Upgrade n8n to version 2.39.6 or 2.40.1 or later without delay.
Rotate every credential stored in n8n, including API keys, OAuth tokens, SSH keys, and database passwords, assuming disclosure.
Audit workflows and agent definitions created since the vulnerable versions were deployed and remove any that reference unauthorized credentials.
Restrict workflow creation privileges to trusted users until patching is complete.

Patch Information

Fixed releases are 2.39.6 and 2.40.1. Patch details and upgrade guidance are published in the GitHub Security Advisory GHSA-9rhv-fhr8-7q5r. Self-hosted operators should upgrade the container image or npm package and restart worker processes. Cloud-hosted tenants should confirm with their provider that the patched build is deployed.

Workarounds

Disable inline AI agent node-tool features in workflows until the patch is applied.
Enforce least privilege on n8n user roles and limit who can create or edit workflows.
Place the n8n instance behind network controls that block egress to arbitrary external endpoints.
Segment credential storage by project and avoid sharing high-value credentials across tenants.

bash

# Upgrade n8n via npm
npm install -g n8n@2.40.1

# Or pull the patched Docker image
docker pull n8nio/n8n:2.40.1
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.40.1