n8n CVE-2026-103249

Exploitation requires an authenticated n8n account with workflow-authoring privileges (PR:L) to craft and store a malicious script URL in a node's Resource Locator parameter dropdown. It is NOT remote-unauthenticated: a second, distinct user must actively interact (UI:A/UI:R) by opening the affected node's dropdown AND clicking the external-link icon for the payload to fire - passive viewing is insufficient. The vulnerability is in Resource Locator dropdown link handling specifically; impact is amplified in multi-user, collaborative, or workflow-sharing/import deployments because the payload persists across workflow imports and shares, enabling one poisoned workflow to target many victims over time. Single-user or isolated instances where authors only run their own workflows face minimal exposure.

This is a genuine but conditional, mid-tier priority issue rather than an urgent emergency. The vendor (VulnCheck) CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:L/UI:A) reflects two real limiters: the attacker must already be an authenticated workflow author (PR:L) and a second, different user must actively interact (UI:A) by opening the node dropdown and clicking the external-link icon. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no evidence of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The stored/persistent nature (payload survives workflow imports and shares) materially raises real risk versus a reflected XSS because a single malicious shared workflow can repeatedly target many collaborators who import it. The vendor rates confidentiality impact high (VC:H) since execution in the editor origin can access session material, API tokens, and workflow secrets of the victim; integrity and availability are limited (VI:L/VA:N). My own CVSS 3.1 assessment (~7.6, S:C/C:H/I:L) is directionally consistent but numerically higher than the 4.0 score because 3.1 weights the cross-user scope change and C:H more heavily than 4.0 weights UI:A+PR:L - a methodology discrepancy, not a disagreement on the facts. Net: patch on a normal cadence, prioritized for multi-tenant/shared-workflow n8n deployments where untrusted authors and marketplace/imported workflows are common.

An attacker with a low-privilege workflow-author account on a shared n8n instance builds a workflow whose Resource Locator parameter dropdown contains a crafted malicious script URL, then shares or publishes it for import. When a higher-privileged colleague opens that node's dropdown and clicks the external-link icon, arbitrary JavaScript runs in the n8n editor origin, letting the attacker exfiltrate the victim's session/API credentials or act as them. No public proof-of-concept exploit is currently identified, but the persistence across imports and shares makes broad internal targeting straightforward once the poisoned workflow circulates.