CVE-2026-103254
Deferred Deferred - Pending Action

Path Traversal in n8n Workflow Approval System

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103254
EUVD
EUVD-2026-90648

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.80 (exc)
n8n n8n From 2.0.0 (inc) to 2.39.6 (exc)
n8n n8n From 2.40.0 (inc) to 2.40.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in n8n versions before 1.123.80, 2.39.6, and 2.40.1. It affects signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can exploit unresolved traversal sequences in node IDs to create valid approval URLs for gates in projects they cannot access. This enables cross-project approval forgery.

Detection Guidance

To detect this vulnerability, check the installed version of n8n. Run commands like 'n8n --version' or inspect package.json for version details. Compare against affected versions: <1.123.80, >=2.0.0 <2.39.6, or >=2.40.0 <2.40.1. Also review workflows using Send-and-Wait approvals for suspicious approval URLs or unauthorized project access.

Impact Analysis

An attacker could forge approval URLs to gain unauthorized access to restricted workflows or perform actions in projects they shouldn't have access to. This could lead to data leaks, workflow manipulation, or other malicious activities within the n8n instance.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate compliance requirements for GDPR (data protection), HIPAA (health information security), or other regulations. Unauthorized workflow access could result in data breaches or improper handling of sensitive information.

Mitigation Strategies

Immediately update n8n to patched versions: 1.123.80, 2.39.6, or 2.40.1+. Restrict instance access to trusted users only. Audit all Send-and-Wait workflows for unauthorized approvals. Limit workflow creation permissions to prevent exploitation. These steps reduce but do not fully eliminate the risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart