CVE-2026-56776 json
n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
published 2026-06-16 4 mo ago modified 2026-10-29 10 d ago also GHSA-hv7x-3x78-gx53 , EUVD-2026-42263
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.
Patch / fix
- npm n8n 1.123.55, 2.25.7, 2.26.2
- n8n n8n 1.123.55, 2.25.7, 2.26.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L |
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | n8n | <1.123.55 >=2.26.0, <2.26.2 >=2.0.0-rc.0, <2.25.7 |
1.123.55 2.26.2 2.25.7 |
Affected products
- n8n n8n
Classification
References
-
github.com
/n8n-io/n8n/security/advisories/GHSA-hv7x-3x78-gx53
vendor-advisory, web, mitigation
-
vulncheck.com
/advisories/n8n-incorrect-oauth-scope-validation-in-workflow-test-run-endpoint
third-party-advisory
-
github.com
/n8n-io/n8n
package
Sources
- CVE List CVE-2026-56776
- GitHub Advisory GHSA-hv7x-3x78-gx53
- NVD CVE-2026-56776
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.