CVE-2026-103256 Overview
CVE-2026-103256 is a credentials leak vulnerability in n8n, an open-source workflow automation platform. Affected versions send unencrypted passwords for the Wekan and Baserow username-and-password credentials to unvalidated hosts. An attacker with credential update permissions can modify the host field of these credentials and redirect account passwords to an arbitrary endpoint. The flaw bypasses domain validation controls that would otherwise restrict outbound credential submission. The issue is classified under CWE-522: Insufficiently Protected Credentials and affects n8n versions before 2.39.6 and 2.40.0 before 2.40.1.
Critical Impact
Authenticated attackers can exfiltrate stored Wekan and Baserow account passwords to attacker-controlled hosts by altering credential host fields.
Affected Products
- n8n versions before 2.39.6
- n8n 2.40.0 before 2.40.1
- Wekan and Baserow username-and-password credential integrations
Discovery Timeline
- 2026-10-01 - CVE-2026-103256 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-103256
Vulnerability Analysis
n8n stores integration credentials such as the Wekan and Baserow username-and-password credential types to authenticate workflow nodes against downstream services. The vulnerable code path invokes a preauthentication hook that transmits the credential payload, including the plaintext password, to the host specified in the credential configuration. The transmission occurs over an unencrypted channel and without strict validation of the destination host. An authenticated user with permission to update credentials can replace the legitimate target host with an endpoint under their control. The server then forwards the stored password to that endpoint, exposing credentials that may be shared across multiple services or users within the n8n tenant.
Root Cause
The root cause is insufficient validation of the host field in Wekan and Baserow credential records combined with transmission of secrets in cleartext. Domain validation controls intended to restrict outbound destinations do not cover the preauthentication flow, allowing arbitrary host substitution. See the GitHub Security Advisory GHSA-gx6g-2hm7-c4xf for maintainer details.
Attack Vector
Exploitation requires network access to the n8n instance and an authenticated account with permission to modify credentials. The attacker edits an existing Wekan or Baserow credential, changing the host value to an attacker-controlled listener. The next invocation of the preauthentication hook delivers the password in cleartext to that listener. Additional context is available in the VulnCheck Advisory.
No verified proof-of-concept code is published. The vulnerability can be reproduced by configuring a Wekan or Baserow credential, substituting the host field with a controlled HTTP listener, and triggering the preauthentication flow.
Detection Methods for CVE-2026-103256
Indicators of Compromise
- Unexpected modifications to Wekan or Baserow credential host fields in the n8n credentials store.
- Outbound HTTP or HTTPS connections from the n8n server to hosts not associated with legitimate Wekan or Baserow deployments.
- Audit log entries showing credential updates performed by accounts that do not normally manage integrations.
Detection Strategies
- Review n8n audit logs for credentials.update events targeting Wekan or Baserow credential types and correlate with the user and source IP.
- Compare current credential host values against a known-good allowlist of internal Wekan and Baserow endpoints.
- Inspect network telemetry for the n8n host making authentication requests to unfamiliar external domains.
Monitoring Recommendations
- Alert on any change to credential host fields outside approved maintenance windows.
- Baseline egress destinations from n8n worker nodes and flag deviations.
- Capture and retain credential modification events for forensic review following suspected compromise.
How to Mitigate CVE-2026-103256
Immediate Actions Required
- Upgrade n8n to version 2.39.6, 2.40.1, or later immediately.
- Audit all Wekan and Baserow credentials for unexpected host values and reset any passwords suspected of exposure.
- Review the role assignments that grant credential update permissions and revoke access that is not required.
Patch Information
The n8n maintainers address the issue in versions 2.39.6 and 2.40.1. Upgrade instructions and remediation details are published in the GitHub Security Advisory GHSA-gx6g-2hm7-c4xf.
Workarounds
- Restrict the credential update permission to a minimal set of administrators until the patch is applied.
- Enforce network egress controls that limit outbound traffic from n8n to approved Wekan and Baserow hosts only.
- Rotate any Wekan or Baserow passwords stored in n8n after upgrading to invalidate credentials that may have been exposed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
