CVE-2026-103257

Summary

The flaw allows path traversal, enabling attackers to access unintended resources and potentially steal secrets. This matters because it can lead to unauthorized access to sensitive data and workflows.

Exploitability

Exploitation is moderately hard as it requires crafting specific resource IDs, but preconditions include having API key access.

Blast radius

If exploited, attackers could gain unauthorized access to workflows, executions, and credential secrets, impacting data security and integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 1.123.80 or later, or 2.39.6 or later, or 2.40.1 or later, as applicable.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.