Act nowDisclosed

Advisory · CVE-2026-103246

n8n's inline agent spilled any credential to whoever asked

Registering a node tool on an n8n inline agent decrypted and used whatever credential the caller named, with no ownership check, letting an ordinary member exfiltrate plaintext secrets to a host of their choosing.

Advisory published October 1, 2026Independent summary
Vendor
n8n
Product
n8n
Identifier / CWE
CVE-2026-103246
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

n8n kept everyone's house keys in a labeled box and handed over whichever key you pointed at, without checking if it was yours. A regular user could point at the boss's key and have the secret mailed to their own address.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Tool registered

    An ordinary n8n member registers a node tool on an inline agent, triggering input-schema resolution before the language model is consulted.

  2. 02Any credential named

    The caller names an arbitrary credential ID on the instance, including the instance owner's. Credential IDs are not secret and appear in workflow JSON, exports, and editor URLs.

  3. 03Ownership check skipped

    The schema-resolution path decrypts and uses the named credential with no check that the caller's project owns it, unlike the invocation path which has the check.

  4. 04Secret exfiltrated

    The plaintext secret is sent to a host of the attacker's choosing as part of the tool introspection flow.

What happened

n8n’s security advisory GHSA-9rhv-fhr8-7q5r describes a missing authorization check (CWE-639) in the inline agent node-tool path. Registering a node tool on an inline agent resolved the tool’s input schema before the language model was consulted, and that resolution decrypted and used whatever credential the caller named, with no check that the caller’s project owns it. The equivalent check exists on the tool invocation path, so this was the introspection path’s gap.

An ordinary member could therefore name any credential ID on the instance, including the instance owner’s, and have its plaintext secret sent to a host of their choosing. Credential IDs are not secret: they appear in workflow JSON, exports, and editor URLs. The issue affects n8n versions before 2.39.6 and 2.40.0 before 2.40.1, and is fixed in 2.39.6 and 2.40.1.

What to do

  1. Upgrade to n8n 2.39.6 or 2.40.1 or later.
  2. Until patched, restrict n8n instance access to fully trusted users only.
  3. Audit inline agent workflow configurations for unexpected tool node credential references and remove anything unrecognized.
  4. Rotate any credentials whose IDs may have been exposed through workflow JSON, exports, editor URLs, or API responses visible to untrusted members.
  5. Review outbound request logs for unexpected destinations tied to agent tool introspection.

Management note

This one is a quiet credential harvester: no exploit chain needed, just a low-privilege member naming the right ID. If your n8n instance holds production secrets, treat this as a credential-exposure event until the rotation and log review say otherwise.