CVE-2026-103259

Summary

The vulnerability allows attackers to capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint, enabling unauthorized credential access.

Exploitability

Exploitation requires attackers to have resolver registration capability and can be moderately difficult due to the need for specific conditions during the account connection flow.

Blast radius

If exploited, attackers can gain unauthorized access to collaborators' credentials, potentially leading to data breaches or unauthorized actions within the n8n platform.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 2.39.6 or later, or 2.40.1 or later, to address the session token leakage vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.