Cve 2026 103251

n8n's queue-mode handler skipped name, permission, checksum and npm safety checks, so Redis write access could install any npm package cluster-wide. Fixed; no known exploitation.