[CVE-2026-103246] n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inl…

Descripción técnica

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.

Puntuación CVSS

Score: 7.7/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Debilidades (CWE)

CWE-639

Fuente oficial

Publicado en NIST NVD.