n8n: Path traversal in n8n node via unvalidated resource IDs
Summary
The built-in n8n node of n8n builds Public API request paths from a caller-supplied resource ID without encoding or validating it. An attacker who controls an ID value passed to the node can redirect API calls to unintended resources within the scope of the stored API key. This can expose or modify workflows, executions and credential secrets; the vendor states that exploitation requires a workflow that binds the ID field to untrusted input.
Affected
- n8n before 1.123.80
- n8n 2.0.0 before 2.39.6
- n8n 2.40.0 before 2.40.1
Fixed in
- Upgrade to n8n 1.123.80, 2.39.6 or 2.40.1 (or later).
- Cloud instances are patched automatically according to the vendor.
Workaround
- Restrict instance access to fully trusted users only.
- Audit workflows using the n8n node and ensure ID fields are not bound to untrusted or external input.
- Restrict or disable public webhook endpoints feeding workflows that use the n8n node until patched.
- Review and rotate API credentials that may have been exposed through such workflows.
- These measures are short-term only and do not fully remediate the risk.
Exploitation
- No confirmed exploitation in the wild found; not listed in CISA KEV according to an aggregator.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- The CVSS vector carries E:P (proof-of-concept), but no public exploit code was found.
- Unknown: whether a private exploit exists and whether scanning has been observed.
Our recommendation
- Inventory all n8n instances (self-hosted and cloud) and check their versions.
- Patch self-hosted instances to a fixed version first.
- Review workflows where IDs come from webhooks, forms or other external input.
- Rotate API keys and credentials on any instance that was exposed while vulnerable.
- Note: CVSS 4.0 score 8.1 per vendor/NVD record; some third-party sites list different scores.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-89p4-6h98-c7xm github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-103257 osv.dev
- n8n community security update community.n8n.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:03.
Original description (NVD)
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.