CVE-2026-126387 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
n8n before 2.46.1 lets an authenticated member pass absolute file paths to the Browser Use browser_upload tool. Playwright then reads those files from the n8n server and returns their contents through the browser page, exposing instance configuration.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed n8n instances before 2.46.1 where members can run workflows or agents that use the Browser Use browser_upload tool with a connected remote browser session. Instances without that tool or without remote browser sessions are not exposed to this path. Access requires an authenticated member account.
Not affected if auth-required, default-config
Who cares ai-agents, browser-use, n8n, self-hosted
n8n --version or the instance's About page; versions below 2.46.1 are affected.2.46.1 or later.n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.