n8n Cross-Site Scripting and Open Redirect Vulnerability (CVE-2026-56354): Medium Severity

Overview

A security flaw has been found in n8n, an open-source workflow automation tool. This vulnerability affects the “Form Node” feature, potentially allowing attackers to inject harmful scripts or redirect users to malicious websites. It impacts both the community and enterprise versions of n8n.

CVE Details

• Product Name: n8n
• Published Date: July 10, 2026
• Severity: Medium
• Status: Analyzed

Affected Products

This vulnerability impacts n8n versions prior to:

• 1.123.24
• 2.10.4
• 2.12.0

This includes both the community and enterprise editions across its 1.x and 2.x branches.

Current Status

The vulnerability is currently “Analyzed”, meaning it has been reviewed and understood.

Severity Level

The vulnerability has been assigned a “Medium” severity level with a CVSS score of 4.1. This indicates that while exploitation requires an authenticated user with specific permissions and user interaction, it can lead to issues like phishing or injecting malicious content.

Possible Solutions

The good news is that fixes are available!

• Patches: Users should upgrade their n8n installation to version 1.123.24, 2.10.4, 2.12.0, or any later versions to resolve this vulnerability.
• Temporary Workarounds (if immediate upgrade is not possible):
  • Restrict workflow creation and editing permissions to only fully trusted administrative users.
  • To disable the vulnerable Form node, set the environment variable NODES_EXCLUDE to include n8n-nodes-base.form.
  • To disable the Form Trigger node, set the environment variable NODES_EXCLUDE to include n8n-nodes-base.formTrigger.

  It is important to remember that these workarounds are not a complete fix and should only be used temporarily.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c
https://www.vulncheck.com/advisories/n8n-cross-site-scripting-and-open-redirect-in-form-node