{"id":"CVE-2026-103247","published":"2026-10-01T11:17:18.070","lastModified":"2026-10-01T20:17:22.590","description":"n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-7gjv-rcf8-x5qc","tags":[]},{"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.80-credential-tampering-via-duplicate-node-ids","tags":[]}],"exploitRefs":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-7gjv-rcf8-x5qc","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers with editor access to shared workflows to tamper with credentials by exploiting duplicate node IDs, leading to unauthorized access to sensitive information.","exploitability":"Exploitation requires editor access to shared workflows and the presence of duplicate node IDs. This makes it moderately exploitable.","blast_radius":"If exploited, attackers can gain unauthorized access to sensitive credentials and redirect secrets to attacker-controlled hosts, potentially leading to significant data breaches.","remediation":"Upgrade to n8n version 1.123.80 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","credential-tampering","workflow","editor-access"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-04T08:41:48.050Z"}}