CyberRota Analysis
AI-GeneratedVersions of n8n prior to 2.39.6 and between 2.40.0 and 2.40.1 are vulnerable due to inadequate validation of credential ownership during inline agent node-tool introspection. This flaw allows attackers to access arbitrary credential IDs, enabling them to decrypt and exfiltrate sensitive plaintext secrets to their own servers. Organizations using affected n8n versions should prioritize patching to mitigate the risk of credential theft and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.