Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-103251

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 0 to < 1.123.80affected
  • 2.0.0 to < 2.39.6affected
  • 2.40.0 to < 2.40.1affected
pkg:npm/n8n

References