CVE-2026-56776: N8n Authorization Bypass Vulnerability

CVE-2026-56776 Overview

CVE-2026-56776 is an authorization bypass vulnerability in n8n, the open-source workflow automation platform. The flaw resides in the POST /workflows/{workflowId}/test-runs/new endpoint, which incorrectly authorizes requests using the workflow:read scope instead of workflow:execute. Authenticated users holding read-only access can trigger real evaluation test runs, causing workflows to execute through the internal workflow runner. The issue affects n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, and specifically impacts instances using the Evaluations feature where role-based access control (RBAC) project roles grant workflow:read without workflow:execute. The weakness is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated read-only users can execute workflows, triggering unintended outbound API calls, data mutations, and side effects in connected downstream systems.

Affected Products

n8n versions prior to 1.123.55
n8n versions prior to 2.25.7
n8n versions prior to 2.26.2

Discovery Timeline

2026-07-08 - CVE-2026-56776 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56776

Vulnerability Analysis

n8n exposes evaluation test runs through the POST /workflows/{workflowId}/test-runs/new endpoint. This endpoint is intended to launch a workflow evaluation, which invokes the internal workflow runner and executes all configured nodes. The endpoint should require the workflow:execute scope, since it produces the same runtime effects as directly running a workflow.

Instead, the endpoint enforces only workflow:read. Any authenticated user with read access to a workflow can invoke the endpoint and cause a full execution. Downstream integrations, such as HTTP nodes, database nodes, or SaaS connectors, will fire with the workflow's stored credentials. The result is unauthorized outbound API calls, unintended data mutations, and observable side effects in connected systems.

Root Cause

The root cause is incorrect scope validation in the request handler for the test-runs endpoint. The RBAC middleware compares the caller's project role against the wrong permission constant, granting execution rights to any principal with the read scope. The mismatch violates the principle of least privilege and separates authorization intent from runtime effect.

Attack Vector

Exploitation requires network access to the n8n API and valid credentials for an account holding a read-only project role on the target workflow. The attacker sends an authenticated HTTP POST request to /workflows/{workflowId}/test-runs/new, referencing a workflow that contains sensitive automations. The server dispatches the workflow to the internal runner, and every downstream node executes with the workflow owner's stored credentials. No user interaction and no elevated privilege are required beyond the read scope.

See the VulnCheck Security Advisory for further technical detail.

Detection Methods for CVE-2026-56776

Indicators of Compromise

Unexpected HTTP POST requests to /workflows/{workflowId}/test-runs/new originating from accounts holding only viewer or read-only project roles.
Workflow execution log entries triggered by users who lack the workflow:execute scope.
Anomalous outbound API calls, webhook deliveries, or database writes from n8n workers correlated with test-run invocations.

Detection Strategies

Correlate n8n audit logs against the RBAC role assignments to identify executions initiated by read-only principals.
Baseline the volume and origin of /test-runs/new requests and alert on invocations from user identities that historically only perform read operations.
Instrument the n8n reverse proxy or API gateway to log the caller identity, workflow ID, and HTTP method for every request to workflow endpoints.

Monitoring Recommendations

Forward n8n application logs and execution logs to a centralized log platform and retain them for post-incident review.
Monitor stored-credential usage on connected downstream systems for spikes tied to evaluation runs.
Alert on new evaluation configurations created on workflows that touch production data or external APIs.

How to Mitigate CVE-2026-56776

Immediate Actions Required

Upgrade n8n to version 1.123.55, 2.25.7, 2.26.2, or later, matching your deployment channel.
Audit all project role assignments and remove read-only access from users who should not trigger workflow executions.
Review recent evaluation test runs for workflows containing outbound integrations and validate that downstream side effects were intended.

Patch Information

n8n released fixed builds in versions 1.123.55, 2.25.7, and 2.26.2. The patch enforces the workflow:execute scope on the POST /workflows/{workflowId}/test-runs/new endpoint. Refer to the n8n GitHub Security Advisory GHSA-hv7x-3x78-gx53 for full release notes.

Workarounds

If immediate patching is not possible, disable the Evaluations feature on affected instances until the upgrade completes.
Restrict network access to the n8n API so only trusted operators can reach workflow endpoints.
Temporarily elevate role assignments so that only members intended to execute workflows retain any access to sensitive workflows, removing read-only viewers from those projects.

bash

# Verify the running n8n version and upgrade via npm
n8n --version
npm install -g n8n@1.123.55
# Or for the 2.x branch
npm install -g n8n@2.26.2