CVE-2026-103251

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0

Description A validation bypass exists in the community package installation handler for queue mode deployments. Attackers with write access to Redis can circumvent name validation, permission checks, checksum verification, and npm safety checks. This allows the installation of arbitrary npm packages across all cluster instances without authentication.

Recommendations Update n8n to version 1.123.80 or later. Update n8n to version 2.39.6 or later. Update n8n to version 2.40.1 or later.