n8n: N8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST…
n8n
- Severity
- High, CVSS 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
- Record
- CVE-2026-56776
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 8, 2026
- Source last modified
- July 9, 2026
Description
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for automating tasks by connecting apps and services into step-by-step workflows. It affects versions before 1.123.55, 2.25.7 and 2.26.2. It mainly matters if your organization uses the Evaluations feature, which runs workflows as tests, and gives some people a role that lets them view a workflow but not run it. Such a signed-in user could start a real test run, which makes the workflow actually run. That could send unexpected requests to other services, change data, or cause other effects in the systems the workflow connects to. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should check which version is currently in use.
- If that version is one of the affected ones listed above, update n8n to one of the versions that fix this flaw:
1.123.55,2.25.7or2.26.2. The vendor advisory linked on this page can help you choose the right one for your setup. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- If your organization uses the Evaluations feature, treat this update as a priority, since that is where the problem mainly shows up.
Analysis written from the source record as of July 9, 2026 and reviewed before publishing.