n8n: N8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO…
n8n
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- Record
- CVE-2026-56350
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 30, 2026
- Source last modified
- July 2, 2026
Description
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting different apps and services into step-by-step workflows. This flaw affects versions before 2.8.0 that use single sign-on, where staff log in through your organization's central login service. Someone who already has a single sign-on account could use the product's programming interface (the way other software talks to it) to switch off the rule that forces everyone to log in that way. They could then create a local password and log in directly, getting around your login policies and the extra login check, such as a code on a phone, that your login service requires. This flaw is rated High.
What to do
- If someone on your staff installed or runs n8n for your organization, ask them to check which version you use.
- If it is older than
2.8.0, have them update to version2.8.0or later, which fixes this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- After the update, have whoever runs n8n check that single sign-on is still required for everyone and that no one has set up an unexpected local password.
Analysis written from the source record as of July 2, 2026 and reviewed before publishing.