Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103259n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

High 7.6

In plain English

A high-severity incorrect authorization in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 2.39.62.40.0 – before 2.40.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-rx55-8qhx-4hwx) vendor-advisory
VulnCheck Advisory: n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials third-party-advisory