PT-2026-103789

CVE-2026-103256

Published

2026-10-01

Updated

2026-10-01

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n version 2.40.0

Description A credentials leak exists in the Wekan and Baserow username-and-password credentials. This issue allows the transmission of unencrypted passwords to unvalidated hosts. An attacker with permissions to update credentials can modify the host field to redirect account passwords to arbitrary hosts, effectively bypassing domain validation controls.

Recommendations Update n8n to version 2.39.6 or later. Update n8n to version 2.40.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nlgbao1340

Vendors

Affected products

Weakness enumeration

CWE-522: Insufficiently Protected Credentials

Related identifiers