N8n Before 2.39.6 And 2.40 X Before 2.40.1 Credential Disclosure Via Node Tool Introspection

Back www.vulncheck.com

N8n Before 2.39.6 And 2.40 X Before 2.40.1 Credential Disclosure Via Node Tool Introspection

www.vulncheck.com • October 1, 2026

Share: View original

n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n >= 2.40.0, = 2.40.0, < 2.40.1

CWE-639 Authorization Bypass Through User-Controlled Key

GitHub Security Advisory (GHSA-9rhv-fhr8-7q5r)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

N8n Vulnerabilities Lead to Credential Disclosure and Tampering Risks Two vulnerabilities have been identified in n8n, affecting versions before 2.39.6 and 2.40.x before 2.40.1, and versions before 1.123.80. The first vulnerability allows credential disclosure via node-tool introspection, categorized as CWE-639, with GitHub Security Advisory GHSA-9rhv-fhr8-7q5r. The second vulnerability involves credential tampering due to duplicate node IDs. Both vulnerabilities could potentially expose sensitive information and allow unauthorized access. Users are advised to upgrade to the latest versions to mitigate these risks. No has been reported at this time. 46

Extracted Entities

CWE Weaknesses (1)

CWE-639 - Authorization Bypass Through User-Controlled Key (IDOR)

Vulnerabilities (2)

Authorization Bypass Through User-Controlled Key Credential Disclosure