CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

CVE-2026-103252

Versions of n8n prior to 1.123.80, 2.39.6, and 2.40.1 are vulnerable to an authorization bypass in the credential test endpoint . The root cause is the resolution of project-scoped variables without validating caller access. An attacker can provide an arbitrary project ID in the request body to i...