CVE-2026-103256: Insufficiently Protected Credentials in n8n-io n8n
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.
AI Analysis
Technical Summary
CVE-2026-103256 is a credentials leak vulnerability in n8n affecting versions before 2.39.6 and versions 2.40.0 before 2.40.1. The vulnerability involves unencrypted transmission of Wekan and Baserow username-and-password credentials to hosts that are not validated. An attacker with credential update permissions can modify the host field to redirect these credentials to arbitrary hosts, effectively bypassing domain validation controls and exposing sensitive account passwords.
Potential Impact
The vulnerability allows attackers with credential update permissions to exfiltrate account passwords by redirecting them to arbitrary hosts. This could lead to unauthorized access to user accounts and compromise of sensitive data. The CVSS 4.0 score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
A fix is available in n8n versions 2.39.6 and 2.40.1. Users should upgrade to at least these versions to remediate the vulnerability. Since the vulnerability requires credential update permissions, limiting such permissions can reduce risk until patched.
CVE-2026-103256: Insufficiently Protected Credentials in n8n-io n8n
Description
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.
CVSS v4.0
Score 7.1high
Affected software
n8n-io
n8n
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103256 is a credentials leak vulnerability in n8n affecting versions before 2.39.6 and versions 2.40.0 before 2.40.1. The vulnerability involves unencrypted transmission of Wekan and Baserow username-and-password credentials to hosts that are not validated. An attacker with credential update permissions can modify the host field to redirect these credentials to arbitrary hosts, effectively bypassing domain validation controls and exposing sensitive account passwords.
Potential Impact
The vulnerability allows attackers with credential update permissions to exfiltrate account passwords by redirecting them to arbitrary hosts. This could lead to unauthorized access to user accounts and compromise of sensitive data. The CVSS 4.0 score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
A fix is available in n8n versions 2.39.6 and 2.40.1. Users should upgrade to at least these versions to remediate the vulnerability. Since the vulnerability requires credential update permissions, limiting such permissions can reduce risk until patched.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-30T10:55:39.869Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abe7484a43b0b3b89bd113d
Added to database: 10/01/2026, 14:56:04 UTC
Last enriched: 10/01/2026, 15:15:09 UTC
Last updated: 10/02/2026, 00:53:23 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.