n8n: Authorization bypass leads to credential disclosure in inline agent tools
Summary
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 do not check credential ownership when a node tool is registered on an inline agent. An attacker with an ordinary low-privilege account can reference credential IDs of other projects, including the instance owner's, and have the decrypted secrets sent to a host they control. Credential IDs are visible in workflow JSON, exports and editor URLs, so they are not secret.
Affected
- n8n versions before 2.39.6
- n8n versions 2.40.0 before 2.40.1
- The 1.x line is not listed as affected in the CVE or GHSA, but this has not been verified independently. Check the vendor advisory before assuming 1.x is safe.
Fixed in
- 2.39.6 (stable branch)
- 2.40.1 (beta branch)
- n8n cloud instances are patched automatically according to the vendor bulletin.
Workaround
- Restrict n8n instance access to fully trusted users only.
- Audit inline agent workflows for unexpected tool node credential references and remove unrecognized ones.
- Rotate credentials whose IDs may have been exposed to untrusted members.
- These measures are temporary and do not fully remediate the risk.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No public proof-of-concept or exploit code was found in the sources reviewed. This is not proof that none exists.
- Not listed as known exploited (KEV) according to a third-party aggregator; the CISA catalogue was not checked directly.
Our recommendation
- Identify all n8n instances and their versions, including self-hosted and cloud, stable and beta branches.
- Upgrade self-hosted instances to 2.39.6 or 2.40.1 or later and verify 1.x separately.
- Until patched, limit access to trusted users and audit inline agent tool configurations.
- Review logs for unusual credential references and rotate secrets that may have been exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9rhv-fhr8-7q5r github.com
- VulnCheck advisory: n8n credential disclosure via node-tool introspection www.vulncheck.com
- n8n community security update, 16 September 2026 community.n8n.io
- OSV: CVE-2026-103246 osv.dev
- n8n 2.39.6 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:25.
Original description (NVD)
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.