CVE-2026-103246

Summary

The flaw allows attackers to decrypt and exfiltrate plaintext secrets by referencing arbitrary credential IDs, bypassing ownership verification.

Exploitability

Exploitation is relatively easy given the lack of ownership verification. Attackers need access to the inline agent node-tool introspection feature.

Blast radius

If exploited, the impact is high as it can lead to complete compromise of sensitive secrets.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 2.39.6 or later, or 2.40.1 or later, to address the vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.