Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: n8n, n8n 2.25.7, 2.26.2 Clear all filters
TI-2026-40942 CVE-2026-56778 · GHSA-g7vr-5v44-rqf5

n8n - Authorization Bypass in Public API Execution Retry Endpoint

Priority LOW 24

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-07-08 Fixed in 2.26.2, 2.25.7 CWE-863
TI-2026-40940 CVE-2026-56776 · GHSA-xhqv-vmw5-79pm

n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

Priority LOW 24

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00276 Published 2026-07-08 Fixed in 1.123.55, 2.26.2 +1 CWE-863
TI-2026-40939 CVE-2026-56775 · GHSA-w79j-mf7m-gfpm

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

Priority LOW 24

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-ap…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00302 Published 2026-07-08 Fixed in 1.123.55, 2.26.2 +1 CWE-863