CVE-2026-56359 Overview
CVE-2026-56359 is a cross-site scripting (XSS) vulnerability in n8n, an open-source workflow automation platform, affecting versions before 2.8.0. The flaw resides in the credential management flow, where authenticated users can inject malicious javascript: URLs into the OAuth2 credential Authorization URL field. When a victim clicks the OAuth authorization button on a crafted credential, the injected script executes in the victim's browser session with the victim's privileges. The vulnerability is tracked under [CWE-79] and referenced in the GitHub Security Advisory GHSA-364x-8g5j-x2pr.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in another user's browser session, potentially leading to session theft, credential exfiltration, or unauthorized workflow manipulation.
Affected Products
- n8n versions prior to 2.8.0
- n8n self-hosted Node.js deployments
- n8n instances exposing shared credential management to multiple users
Discovery Timeline
- 2026-07-08 - CVE-2026-56359 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-56359
Vulnerability Analysis
The vulnerability exists in n8n's credential management interface for OAuth2 credentials. The Authorization URL field accepts user-supplied input without validating the URL scheme. An authenticated attacker can supply a javascript: URI in place of a legitimate https:// OAuth2 endpoint. When the credential is shared with or accessed by another user, and the victim clicks the OAuth authorization button, the browser evaluates the javascript: URI, executing attacker-controlled code in the context of the n8n web application.
The attack requires authenticated access to n8n and user interaction from the victim, which limits reach but remains impactful in multi-tenant or team environments where credentials are shared across workflows. Technical details are documented in the VulnCheck advisory.
Root Cause
The root cause is missing input validation and URL scheme allowlisting on the OAuth2 Authorization URL field. n8n did not restrict the field to http:// or https:// schemes, allowing dangerous pseudo-protocols such as javascript: to be persisted and later rendered as clickable links.
Attack Vector
An authenticated attacker creates a malicious OAuth2 credential with a javascript: payload in the Authorization URL field. The attacker shares the credential or convinces a victim to open it. When the victim clicks the OAuth authorization button, the payload executes in the victim's browser, inheriting their n8n session privileges.
No verified public proof-of-concept code is available. See the vendor advisory for exploitation context.
Detection Methods for CVE-2026-56359
Indicators of Compromise
- OAuth2 credential records containing Authorization URLs that begin with javascript:, data:, or other non-HTTP schemes.
- Unexpected credential creation or modification events originating from low-privilege user accounts.
- Browser console errors or anomalous script execution triggered from n8n credential pages.
Detection Strategies
- Audit the n8n credentials database and export OAuth2 credential fields to search for non-HTTP URL schemes.
- Review application logs for credential create and update API calls that write to the authUrl field.
- Correlate credential modification events with subsequent authorization button clicks by other users.
Monitoring Recommendations
- Enable and centralize n8n audit logs to capture credential lifecycle events.
- Monitor web proxy and browser telemetry for anomalous script execution originating from n8n domains.
- Alert on any newly created credentials whose Authorization URL fields fail a strict URL scheme validation check.
How to Mitigate CVE-2026-56359
Immediate Actions Required
- Upgrade n8n to version 2.8.0 or later, which contains the vendor fix.
- Audit existing OAuth2 credentials and remove any with non-HTTP(S) Authorization URLs.
- Restrict credential creation and sharing permissions to trusted users where feasible.
Patch Information
The issue is resolved in n8n 2.8.0. Refer to the GitHub Security Advisory GHSA-364x-8g5j-x2pr for release details and upgrade instructions.
Workarounds
- If patching is delayed, review all OAuth2 credential Authorization URLs and manually remove entries containing javascript: or other non-HTTP schemes.
- Limit the number of users with permission to create or share credentials in n8n.
- Instruct users to avoid clicking OAuth authorization buttons on credentials created by untrusted accounts until the upgrade is applied.
# Example: query n8n Postgres database for suspicious OAuth2 credential URLs
psql -d n8n -c "SELECT id, name, data FROM credentials_entity WHERE data::text ILIKE '%javascript:%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
