CVE-2026-56777: N8n Auth Bypass Vulnerability

CVE-2026-56777 Overview

CVE-2026-56777 is an abstract syntax tree (AST) validator bypass in the n8n workflow automation platform. The flaw resides in the Python Code node executed by the Python Task Runner. An authenticated user who can create or modify workflows containing a Python Code node can evade the security validator and reach the task executor module namespace. The issue affects self-hosted deployments where the Python Task Runner is enabled. When N8N_BLOCK_RUNNER_ENV_ACCESS is configured to permit access, exploitation can disclose environment variables available to the task runner process. The vulnerability is classified under [CWE-184] (Incomplete List of Disallowed Inputs).

Critical Impact
Authenticated workflow authors can bypass Python sandboxing in n8n to read environment variables from the task runner, potentially exposing API keys, database credentials, and other secrets.

Affected Products

n8n versions prior to 2.25.7
n8n versions 2.26.x prior to 2.26.2
Self-hosted n8n instances with the Python Task Runner enabled

Discovery Timeline

2026-06-30 - CVE-2026-56777 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-56777

Vulnerability Analysis

n8n executes user-authored Python code inside a Task Runner process. Before execution, an AST-based validator inspects submitted code to block access to sensitive attributes and modules. CVE-2026-56777 demonstrates that this allow/deny logic is incomplete. Certain syntactic constructs pass the validator but still resolve at runtime to references inside the task executor module namespace. Once an attacker reaches that namespace, they can enumerate objects the runner imported, including modules that expose process state and environment data.

The severity is bounded by two factors. First, the attacker must already hold n8n credentials with workflow authoring rights. Second, the impact depends on how the operator has configured the runner. If N8N_BLOCK_RUNNER_ENV_ACCESS is set to allow environment access, secrets injected into the runner process become readable through the bypass.

Root Cause

The root cause is an incomplete deny list in the AST validator. The validator enumerates disallowed names and attribute accesses but fails to cover every path that resolves to executor internals. [CWE-184] captures this class of defect where a security control relies on blocking known-bad patterns rather than enforcing a strict allow list.

Attack Vector

Exploitation requires network access to the n8n UI or API and an account with the workflow:create or workflow:update permission. The attacker crafts a Python Code node whose body survives AST inspection but pivots at runtime into the task executor namespace. Executing the workflow returns the disclosed data through node output. No user interaction beyond the attacker's own workflow trigger is required. Technical details are documented in the VulnCheck Advisory and the GitHub Security Advisory.

Detection Methods for CVE-2026-56777

Indicators of Compromise

Python Code nodes containing unusual attribute chains, getattr calls, or reflection patterns targeting __builtins__, __globals__, or os.environ.
Task runner log entries showing Python workflow output that includes environment variable names such as PATH, AWS_, DB_, or credential-prefixed keys.
Workflow modification events by non-administrative users that introduce Python Code nodes on previously JavaScript-only workflows.

Detection Strategies

Audit n8n workflow definitions for Python Code nodes and diff them against a known-good baseline to surface newly added or altered scripts.
Enable and forward n8n audit logs to a centralized log platform, then alert on workflow create or update events tied to Python nodes.
Inspect task runner stdout and workflow execution history for output payloads matching environment variable name patterns.

Monitoring Recommendations

Track n8n version strings exposed on /rest/settings and alert when instances remain below 2.25.7 or 2.26.2.
Monitor process environment reads from the task runner by correlating runner PID activity with unexpected file access to /proc/self/environ on Linux hosts.
Alert on privileged workflow role changes, particularly grants of workflow authoring rights to non-engineering accounts.

How to Mitigate CVE-2026-56777

Immediate Actions Required

Upgrade self-hosted n8n to version 2.25.7 or 2.26.2 or later without delay.
Set N8N_BLOCK_RUNNER_ENV_ACCESS=true to prevent the task runner from reading process environment variables.
Review and rotate any secrets that were exposed as environment variables to the Python Task Runner during the vulnerable window.
Restrict workflow creation and modification permissions to trusted users only.

Patch Information

The n8n maintainers released fixed builds 2.25.7 and 2.26.2 that harden the AST validator against the disclosed bypass. Refer to the GitHub Security Advisory GHSA-jwm3-qcfw-c5pp for release notes and upgrade guidance.

Workarounds

Disable the Python Task Runner if Python Code nodes are not required in your automations.
Run the task runner process with a minimal environment that omits secrets, injecting credentials through n8n's credential store instead.
Isolate the task runner in a dedicated container or namespace with no access to host secrets, IMDS endpoints, or shared credential files.

bash

# Configuration example: block runner environment access and pin a hardened runner env
export N8N_BLOCK_RUNNER_ENV_ACCESS=true
export N8N_RUNNERS_ENABLED=true
# Start n8n only after verifying the installed version
n8n --version   # must report 2.25.7, 2.26.2, or later