CVE-2026-103254: n8n-Io n8n

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.

Affected products

• n8n-Io n8n: before 1.123.80 (fixed in 1.123.80); from 2.0.0, before 2.39.6 (fixed in 2.39.6); from 2.40.0, before 2.40.1 (fixed in 2.40.1)

Published 2026-10-01. Last modified 2026-10-06.