Overview
A security flaw has been found in n8n, a popular workflow automation tool. This vulnerability allows an authenticated user to inject malicious code into the OAuth2 credential authorization URL field. If another user then interacts with this compromised credential, the malicious script can run in their web browser. This issue, tracked as CVE-2026-56359, is rated as a Medium severity risk.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-56359
- Published Date: July 8, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The cross-site scripting (XSS) vulnerability affects versions of n8n prior to 2.8.0 and also versions before 2.6.4. Specifically, any n8n instance running versions older than 2.8.0 or 2.6.4 is at risk.
Current Status
This vulnerability is currently “Analyzed”, meaning it has been officially recognized and details about its nature and impact are available.
Severity Level
The vulnerability CVE-2026-56359 has a CVSS score of 5.4, categorizing it as Medium severity. While an attacker needs to be an authenticated user with specific permissions to exploit this, and it requires user interaction, the potential to execute arbitrary scripts in a victim’s session means it shouldn’t be ignored. Such an attack could lead to unauthorized access to data or actions within the n8n environment.
Possible Solutions
Fortunately, a fix is available for this issue.
- Upgrade: Users are strongly advised to upgrade their n8n installations to version 2.8.0 or later, or to version 2.6.4 or later if they are on the 2.6.x branch. These versions contain the necessary patches to address the XSS vulnerability.
If an immediate upgrade is not possible, consider these temporary mitigation steps:
- **Limit Permissions:** Restrict the ability to create and share credentials to only a handful of highly trusted users within your organization.
- **Restrict Access:** Limit access to your n8n instance to trusted users only.
These workarounds are temporary and do not eliminate the root cause of the vulnerability. Upgrading to a patched version remains the most effective solution.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr
- https://www.vulncheck.com/advisories/n8n-cross-site-scripting-in-credential-management-oauth2-authorization-url
