CVE-2026-56778: N8n Authorization Bypass Vulnerability

CVE-2026-56778 Overview

CVE-2026-56778 is an authorization bypass vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Public API execution retry endpoint, which incorrectly enforces the workflow:read scope instead of the required workflow:execute scope. An authenticated user with read-only access to a shared workflow can retry executions of that workflow through the Public API. This breaks the intended permission boundary between read and execute privileges. The issue affects n8n versions before 2.25.7 and 2.26.x before 2.26.2 where workflows are shared with other users or across projects. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users with read-only permissions can execute shared workflows, bypassing the intended read/execute privilege separation and potentially triggering unauthorized automation runs.

Affected Products

n8n versions prior to 2.25.7
n8n 2.26.x versions prior to 2.26.2
n8n deployments where workflows are shared with other users or across projects

Discovery Timeline

2026-07-08 - CVE-2026-56778 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56778

Vulnerability Analysis

The vulnerability resides in n8n's Public API endpoint responsible for retrying prior workflow executions. The endpoint performs an authorization check using the workflow:read scope. Retrying an execution triggers the workflow to run again, which should require the workflow:execute scope. Because n8n treats retry operations as read-level activity, any user granted read-only sharing on a workflow can invoke the retry endpoint and cause the workflow to execute. This produces the same runtime side effects as a normal execution, including outbound HTTP calls, database writes, credential usage, and third-party integrations. The impact scales with how broadly workflows are shared inside a tenant, especially in multi-project deployments where least-privilege sharing is expected.

Root Cause

The root cause is an incorrect authorization mapping in the Public API route handler. The retry endpoint reuses the scope check applied to read-oriented endpoints such as fetching execution history. Because retrying spawns a new execution using the original workflow definition and stored credentials, the correct scope is workflow:execute. The scope mismatch categorizes this as a broken access control issue under [CWE-863].

Attack Vector

An attacker requires valid authentication and a Public API key or session with read access to a shared workflow. The attacker sends a POST request to the execution retry endpoint referencing a prior execution ID. The API accepts the request based on the workflow:read scope and dispatches a new execution using the original workflow's owner credentials. The attacker does not need to modify the workflow or gain elevated roles. This makes the abuse indistinguishable from legitimate retries in most default audit configurations.

No public proof-of-concept exploit code has been released. The vulnerability is described in detail in the GitHub Security Advisory GHSA-h3jj-5f3v-3685 and the VulnCheck Advisory.

Detection Methods for CVE-2026-56778

Indicators of Compromise

Public API requests to the execution retry endpoint originating from users who hold only workflow:read scope on the target workflow
Unexpected new execution records for shared workflows initiated by non-owner accounts
API key activity where the same key issues retry calls across multiple workflows it does not own

Detection Strategies

Review n8n audit logs and correlate execution retry events with the effective role of the initiating user or API key
Alert on retry calls where the initiator is not the workflow owner and lacks explicit execute permission at the project level
Compare Public API request paths against user scope assignments to surface calls that should have been rejected

Monitoring Recommendations

Forward n8n application and API logs to a centralized logging or SIEM platform for retention and correlation
Track outbound activity from workflows using sensitive credentials to detect executions triggered outside expected schedules
Monitor Public API key issuance and rotation, and disable keys tied to accounts with read-only sharing until the patch is applied

How to Mitigate CVE-2026-56778

Immediate Actions Required

Upgrade n8n to version 2.25.7 or 2.26.2, whichever aligns with the current release track
Audit all Public API keys and revoke keys held by users with read-only workflow access until patching is complete
Review recent execution history for shared workflows and validate that every retry was authorized

Patch Information

The n8n maintainers addressed the vulnerability by changing the required scope on the Public API execution retry endpoint from workflow:read to workflow:execute. Fixed versions are 2.25.7 and 2.26.2. Details are available in the n8n GitHub Security Advisory GHSA-h3jj-5f3v-3685.

Workarounds

Restrict workflow sharing to users who already require execute permissions until the upgrade is completed
Disable or restrict the Public API at the network or reverse-proxy layer for users that only require the web UI
Rotate credentials embedded in shared workflows to limit blast radius from any unauthorized retries that may have occurred

bash

# Upgrade n8n via npm
npm install -g n8n@2.26.2

# Or upgrade the Docker image
docker pull n8nio/n8n:2.26.2
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.26.2

# Verify installed version
n8n --version