Understanding the n8n Authorization Bypass Vulnerability
A security flaw, identified as CVE-2026-56778, has been discovered in n8n, a popular workflow automation platform. This vulnerability allows an authenticated user with limited permissions to perform actions they shouldn’t be able to. Specifically, an attacker with only read-only access to a shared workflow could use the Public API to retry executions of that workflow. This completely bypasses the security controls designed to separate read permissions from execute permissions. This issue is particularly concerning for organizations that use n8n and share workflows among different users or across various projects.
CVE Details
Product: n8n
Published: July 8, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to 2.25.7 and 2.26.x before 2.26.2. If you are running any n8n version earlier than these, your instance is exposed to this authorization bypass.
Current Status
The vulnerability has been thoroughly analyzed, and its impact understood. Official patches have been released to address the issue.
Severity Level
The CVE-2026-56778 vulnerability is rated as Medium severity, with a CVSS score of 6.4. A medium severity rating indicates that while an exploit might not grant full control over the system or access to highly sensitive data, it could still lead to unauthorized operations and potential disruption. In this case, an attacker can manipulate workflow executions even without explicit execution rights, which can lead to unintended processes running or resource consumption.
Possible Solutions
To protect your n8n instance from this authorization bypass, the most effective solution is to update your software immediately. The developers have released patches that fix this issue:
- Upgrade to n8n version 2.25.7 or later.
- Upgrade to n8n version 2.26.2 or later (if you are on the 2.26.x branch).
If an immediate upgrade is not feasible, consider these temporary mitigation steps:
- Restrict workflow sharing: Limit sharing of workflows to only fully trusted users who genuinely require access.
- Restrict Public API access: Implement network access controls to limit who can reach the n8n Public API, ensuring only trusted sources can interact with it.
Please remember that these workarounds only reduce the risk and do not fully eliminate the vulnerability. Upgrading to the patched versions is strongly recommended for complete protection.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685
https://www.vulncheck.com/advisories/n8n-authorization-bypass-in-public-api-execution-retry-endpoint
