The n8n node in affected versions fails to properly validate resource identifiers, resulting in a path traversal vulnerability. This flaw allows attackers to redirect API calls to unintended resources, potentially exposing sensitive workflow data, execution details, and credential secrets accessible via the API key. The vulnerability affects multiple version ranges: all versions prior to 1.123.80 in the 1.x series, versions from 2.0.0 up to but not including 2.39.6, and versions from 2.40.0 up to but not including 2.40.1.

Exploitation of this vulnerability can lead to unauthorized access to sensitive information within the n8n environment, including workflows, executions, and credential secrets. This exposure is limited to the scope of the compromised API key. The CVSS 4.0 base score is 8.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A fix is available in versions 1.123.80, 2.39.6, and 2.40.1 and later. Users should upgrade to these or newer versions to remediate the vulnerability. There is no indication that the vulnerability is mitigated by configuration or other means. Patch status is confirmed by the affected version ranges and the presence of fixed versions immediately following the affected intervals.