n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a flaw that bypasses credential ownership validation during inline agent node‑tool introspection. This allows an attacker to reference arbitrary credential IDs, decrypt the secrets, and exfiltrate plaintext values without having ownership or proper authorization to those credentials. The weakness is classified as CWE‑639, representing a missing authorization check that enables unauthorized credential disclosure.

The affected product is n8n Data‑Integration Platform from n8n‑io, specifically all releases prior to 2.39.6 and before 2.40.1. No specific sub‑version ranges are provided beyond these release markers, so any installation running a v2.39.x series earlier than 2.39.6 or a v2.40.x series earlier than 2.40.1 is considered vulnerable.

The CVSS score of 8.3 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, but the exposure of plaintext credentials is a significant operational risk. Attackers likely need authenticated access that permits node execution or introspection; they may trigger the bug through the UI, API, or automation scripts. Once the flaw is exercised, the attacker can decrypt secrets and send them to any attacker‑controlled endpoint, compromising confidentiality of all stored credentials.