CVE-2026-103255

Summary

The flaw allows path traversal, enabling attackers to access unauthorized data and modify it by leveraging untrusted input in the tableId parameter.

Exploitability

Exploitation is relatively easy given that attackers can use untrusted input to traverse to sensitive APIs, requiring only that the serviceRole key is accessible.

Blast radius

If exploited, this vulnerability could lead to unauthorized data access and modification across the entire system, impacting multiple users and services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.