Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103251n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

High 7.1

In plain English

A high-severity missing authorization in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.802.0.0 – before 2.39.62.40.0 – before 2.40.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-fmmv-p585-7c8x) vendor-advisory
VulnCheck Advisory: n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub third-party-advisory