CVE-2026-103246 is an authorization bypass vulnerability in n8n that affects versions before 2.39.6 and versions 2.40.0 before 2.40.1. The vulnerability arises because the software fails to validate credential ownership during inline agent node-tool introspection. Attackers can exploit this by referencing arbitrary credential IDs, enabling them to decrypt and exfiltrate plaintext secrets to hosts they control without proper authorization checks.

Successful exploitation allows an attacker with limited privileges to bypass authorization controls and access plaintext secrets stored as credentials. This can lead to exposure of sensitive information and potential compromise of systems or services relying on those credentials. The CVSS 4.0 base score is 8.3 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

A fix is available in n8n versions 2.39.6 and 2.40.1. Users should upgrade to at least these versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.