CVE-2026-103252

Summary

The flaw allows attackers to bypass authorization and interpolate sensitive variables in credential test requests, potentially leading to data exfiltration.

Exploitability

Exploitation is moderately hard as it requires attackers to specify an arbitrary project ID, but preconditions include access to the credential test endpoint.

Blast radius

If exploited, this could lead to significant data loss or exposure of sensitive information within the affected projects.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.