CVE-2026-103256

7.1 HIGHpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-522

Public exploit & PoC references

https://github.com/n8n-io/n8n/security/advisories/GHSA-gx6g-2hm7-c4xf

All references

https://github.com/n8n-io/n8n/security/advisories/GHSA-gx6g-2hm7-c4xf
https://www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-credentials-leak-via-preauthentication-hook

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2026-100264
HIGHCVE-2026-100298
MEDIUMCVE-2026-100569PoC
LOWCVE-2026-101089PoC
HIGHCVE-2026-101331
HIGHCVE-2026-102944PoC
HIGHCVE-2026-104051PoC
MEDIUMCVE-2026-104617

Related by shared AI tags and CWE weakness class. Browse the full archive.