What is GHSA-r56q-6p4g-65g7?

GHSA-r56q-6p4g-65g7 is a security advisory published by GitHub Security Advisories with High severity. n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an...

Which CVE IDs does GHSA-r56q-6p4g-65g7 cover?

GHSA-r56q-6p4g-65g7 covers the following CVE IDs: CVE-2026-103252. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r56q-6p4g-65g7?

GHSA-r56q-6p4g-65g7 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-r56q-6p4g-65g7HighCVSS 7.7

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-103252 →

📋 Description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.

🔗 References (4)

https://github.com/n8n-io/n8n/security/advisories/GHSA-7gvh-q9w3-wqqx
https://nvd.nist.gov/vuln/detail/CVE-2026-103252
https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-information-disclosure-via-credential-test-endpoint
https://github.com/advisories/GHSA-r56q-6p4g-65g7