CVE-2026-103247

LOWCVSS 5.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨CRITICAL & HIGH - Multiple Critical Vulnerabilities in n8n (CVE-2026-103246 – CVE-2026-103259) Multiple security vulnerabilities were identified in n8n workflow automation platform affecting versions prior to 1.78.0. Flaws range from unauthenticated arbitrary file read (CVE-2026-103253), RCE in Form Trigger (CVE-2026-103246), SSH command injection (CVE-2026-103257), dynamic expression code execution (CVE-2026-103250), OAuth2 auth bypass (CVE-2026-103256), and workspace privilege escalation (CVE-2026-103247), alongside SSRF, Stored XSS, IDOR, and credential leakage issues. 👉Affected: n8n < 1.78.0 | Upgrade to 1.78.0 or later
1000065
308 followersView on X

Explore more

Back to dashboard