CVE-2026-103251: n8n Queue Mode Auth Bypass Vulnerability

CVE-2026-103251 Overview

CVE-2026-103251 is a validation bypass vulnerability in n8n, the workflow automation platform. The flaw resides in the community package installation handler used by queue mode deployments. Attackers with Redis write access can issue crafted pub/sub messages that bypass name validation, permission checks, checksum verification, and npm safety checks. The result is arbitrary npm package installation across every instance in the n8n cluster without authentication. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Attackers with Redis write access can install arbitrary npm packages across all n8n cluster instances, enabling cluster-wide code execution without authentication.

Affected Products

n8n versions before 1.123.80
n8n versions from 2.0.0 before 2.39.6
n8n versions from 2.40.0 before 2.40.1

Discovery Timeline

2026-10-01 - CVE CVE-2026-103251 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103251

Vulnerability Analysis

n8n supports a queue mode deployment that distributes workflow execution across multiple worker instances. The instances coordinate through a Redis pub/sub channel. Among the orchestrated messages is a community package installation command that propagates package operations to all cluster members.

The installation handler on each receiving instance trusts the message contents. It skips the validation routines applied to user-initiated installs performed through the authenticated UI or REST API. As a result, an attacker who can publish on the Redis channel directs every instance to install an attacker-controlled npm package. Loading the package into the n8n process grants the attacker code execution in the context of the n8n workers.

Root Cause

The pub/sub consumer invokes the community package installer without re-running the authorization and safety checks that the authenticated code path enforces. Name validation, role-based permission checks, checksum verification, and npm safety validation are all skipped for messages originating on the queue bus. The handler treats Redis as an implicitly trusted transport.

Attack Vector

Exploitation requires network access to the Redis instance that backs n8n queue mode and the ability to publish messages on the coordination channel. An attacker on the adjacent network, or an attacker who has obtained Redis credentials, publishes a crafted installation message naming an arbitrary npm package. Each subscribed n8n instance installs and loads the package. The package can contain install scripts or runtime code that executes with the privileges of the n8n process. See the GitHub Security Advisory and the VulnCheck Advisory on n8n for additional technical context.

No verified public proof-of-concept code is available at this time. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2026-103251

Indicators of Compromise

Unexpected entries in the n8n community packages registry or in the nodes_package table that do not correspond to administrator actions.
New npm packages present on worker filesystems under the n8n user directory without a matching audit log entry.
Outbound network connections from n8n worker processes to attacker-controlled hosts following a package install event.
Redis PUBLISH commands targeting the n8n coordination channel from clients outside the known n8n instance set.

Detection Strategies

Correlate n8n application logs recording community package installations with authenticated API or UI activity. Flag installations with no originating user session.
Monitor Redis MONITOR output or proxy logs for PUBLISH operations on n8n coordination channels from unexpected source addresses.
Baseline the set of installed community packages per cluster and alert on deltas introduced outside of change windows.

Monitoring Recommendations

Enable Redis authentication logging and ship events to a central log platform for retention and correlation.
Alert on child processes spawned by n8n workers that invoke npm install or network utilities outside expected workflow executions.
Track file creation events under node_modules directories owned by the n8n service account.

How to Mitigate CVE-2026-103251

Immediate Actions Required

Upgrade n8n to 1.123.80, 2.39.6, or 2.40.1 or later depending on the branch deployed.
Restrict Redis network exposure to the n8n worker subnet only and enforce requirepass or TLS client authentication.
Rotate Redis credentials and audit recently installed community packages across all cluster instances.
Review n8n worker hosts for unexpected npm packages, scheduled tasks, or outbound connections created after the vulnerability window opened.

Patch Information

The n8n maintainers released fixed builds in versions 1.123.80, 2.39.6, and 2.40.1. The patched installation handler re-applies name validation, permission checks, checksum verification, and npm safety checks when processing community package messages received over the Redis pub/sub channel. Patch details are published in the GitHub Security Advisory GHSA-fmmv-p585-7c8x.

Workarounds

Disable the community packages feature by setting N8N_COMMUNITY_PACKAGES_ENABLED=false on all n8n instances if upgrading is not immediately feasible.
Place Redis behind a firewall or network policy that permits connections only from authorized n8n hosts.
Require strong Redis authentication and, where supported, TLS to prevent unauthenticated pub/sub publishing.
Run n8n workers under a dedicated low-privilege service account to limit the blast radius of any installed package.

bash

# Disable community packages on each n8n instance until patched
export N8N_COMMUNITY_PACKAGES_ENABLED=false

# Require authentication on Redis (redis.conf)
requirepass <strong-random-secret>
bind 10.0.0.10 127.0.0.1
protected-mode yes