CVE Feed

    Dashboard / CVE / CVE-2026-103254

    CVE-2026-103254

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.

    Published:Oct 1, 2026
    Last Modified:Oct 6, 2026
    EPS:Oct 1, 2026
    EPSS Score:0.0028
    CVSS Score:6.3

    Affected Products

    Vendor
    N8n
    Product
    N8n

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-119557 (CVSS 8.2) — n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unau…
    CVE-2026-119408 (CVSS 8.7) — n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability v…
    CVE-2026-118679 (CVSS 6.9) — n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trig…
    CVE-2026-118678 (CVSS 7.1) — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privil…
    CVE-2026-118677 (CVSS 5.9) — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway …
    CVE-2026-118676 (CVSS 5.1) — n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member user…
    CVE-2026-118675 (CVSS 5.1) — n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors o…
    CVE-2026-118649 (CVSS 8.7) — n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's ow…
    CVE-2026-118648 (CVSS 8.4) — n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulner…
    CVE-2026-118647 (CVSS 5.3) — n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token i…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High