n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| n8n | n8n | before 1.123.55 | 1.123.55 | Patch available | CNA |
| n8n | n8n | 2.26.0 to before 2.26.2 | 2.26.2 | Patch available | CNA |
| n8n | n8n | 2.0.0-rc.0 to before 2.25.7 | 2.25.7 | Patch available | CNA |
- n8n Vendorn8n Affected before 1.123.55 Fixed in 1.123.55 Patch available CNA
- n8n Vendorn8n Affected 2.26.0 to before 2.26.2 Fixed in 2.26.2 Patch available CNA
- n8n Vendorn8n Affected 2.0.0-rc.0 to before 2.25.7 Fixed in 2.25.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:* | before 1.123.55; 2.0.0 to before 2.25.7; 2.26.0 to before 2.26.2 | Vulnerable | n8n |
- cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:* Versions before 1.123.55; 2.0.0 to before 2.25.7; 2.26.0 to before 2.26.2 Vulnerable ·n8n
Remediation
- Fix · CNA n8n (n8n) Fixed in 1.123.55
- Fix · CNA n8n (n8n) Fixed in 2.26.2
- Fix · CNA n8n (n8n) Fixed in 2.25.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
n8n 2.25.7, 2.26.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-40942 n8n - Authorization Bypass in Public API Execution Retry EndpointPriority LOW 24
- TI-2026-40940 n8n - Incorrect OAuth Scope Validation in Workflow Test Run EndpointPriority LOW 24
- Release ·
n8n 1.123.55
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-40940 n8n - Incorrect OAuth Scope Validation in Workflow Test Run EndpointPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56775
- 2026-10-03 Alias added: GHSA-w79j-mf7m-gfpm
- 2026-10-29 Affected versions changed · CNA
References
More N8n vulnerabilities
- TI-2025-42131 n8n Vulnerable to Remote Code Execution via Expression Injection KEVCVSS 3.1CRITICAL 10.0
- TI-2026-17560 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVSS 3.1CRITICAL 10.0
- TI-2026-01167 Authenticated users can bypass the Expression sandbox mechanism to achieve full remote… CVSS 3.1CRITICAL 9.9
- TI-2026-00644 Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host. CVSS 3.1CRITICAL 9.9
- TI-2025-35293 An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3… CVSS 3.1HIGH 8.8
- TI-2023-12275 The n8n package 0.218.0 for Node.js allows Escalation of Privileges. CVSS 3.1HIGH 8.8
Sources
- CVE-2026-56775 · CVE Program
- CVE-2026-56775 · NVD
- FIRST EPSS
- GHSA-w79j-mf7m-gfpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences