CVE-2026-56349: n8n input validation bypass

CISO Take

n8n's Guardrail node fails to properly validate inputs (CWE-20), letting any end user of an n8n workflow craft text that bypasses the guardrail instructions configured to constrain AI agent behavior. This matters because n8n is a widely deployed low-code AI agent automation platform with 16 downstream dependents and a history of 136 other CVEs, and the flaw lets a normal, low-privileged workflow user defeat the exact control an admin configured to keep agent actions safe and compliant — undermining trust boundaries in agentic automation rather than requiring any special access. There is no CVSS score, EPSS data, or CISA KEV listing yet, and no public exploit code or Nuclei template has surfaced, so this is not being mass-exploited today, but the technique itself (crafting bypass text) requires no special tooling. Upgrade to n8n 2.10.0 or later immediately; until patched, treat the Guardrail node as advisory rather than a hard security boundary, add independent output validation downstream of any agent using it, and audit workflow execution logs for inputs that correlate with guardrail-adjacent actions succeeding unexpectedly.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

Severity is formally unscored (no CVSS/EPSS), not KEV-listed, and no public exploit or scanner template exists, so near-term mass exploitation is unlikely. However, exploitation complexity is low — it requires only crafting text input as a normal workflow user, no special privileges or tooling — and the impact category is meaningful: it defeats a safety control specifically designed to constrain AI agent behavior in production automations. Overall risk should be treated as Medium: low urgency for emergency patching absent active exploitation signals, but high priority for any organization treating the Guardrail node as a primary safety boundary for agentic workflows.

How does the attack unfold?

Initial Access

Attacker, as a normal end user of an n8n-orchestrated AI agent workflow, submits a specially crafted text input.

AML.T0051.000

Guardrail Evasion

The crafted input exploits the Guardrail node's input validation flaw, causing configured safety rules to be evaluated incorrectly and bypassed.

AML.T0054

Unrestricted Agent Execution

The underlying AI agent processes the unfiltered instruction and takes an action or generates output the guardrail was meant to block.

AML.T0053

Impact

Workflow integrity and safety guarantees are compromised, potentially exposing users or the organization to unsafe agent behavior or non-compliant output.

AML.T0048.003

Initial Access

Attacker, as a normal end user of an n8n-orchestrated AI agent workflow, submits a specially crafted text input.

AML.T0051.000

Guardrail Evasion

The crafted input exploits the Guardrail node's input validation flaw, causing configured safety rules to be evaluated incorrectly and bypassed.

AML.T0054

Unrestricted Agent Execution

The underlying AI agent processes the unfiltered instruction and takes an action or generates output the guardrail was meant to block.

AML.T0053

Impact

Workflow integrity and safety guarantees are compromised, potentially exposing users or the organization to unsafe agent behavior or non-compliant output.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
205.4K OpenSSF 6.7 Pushed 2d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade n8n to version 2.10.0 or later, which contains the fix per the vendor advisory (GHSA-fvfv-ppw4-7h2w). Until upgraded: do not rely on the Guardrail node as the sole safety control for agent workflows — add independent, redundant output validation or allowlisting outside n8n; restrict who can submit inputs to guardrail-protected workflows; review workflow execution logs for inputs that produced unexpected agent actions or outputs; monitor the vendor advisory and VulnCheck writeup for IOCs or refined exploitation detail as they emerge.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Jailbreak Prompt Injection Agent Plugin AML.T0051.000 - Direct AML.T0054 - LLM Jailbreak AML.T0065 - LLM Prompt Crafting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system verification and validation

NIST AI RMF

MANAGE-2.3 - Mechanisms for managing AI risks are in place and effective

OWASP LLM Top 10

LLM01:2025 - Prompt Injection

Frequently Asked Questions

What is CVE-2026-56349?

n8n's Guardrail node fails to properly validate inputs (CWE-20), letting any end user of an n8n workflow craft text that bypasses the guardrail instructions configured to constrain AI agent behavior. This matters because n8n is a widely deployed low-code AI agent automation platform with 16 downstream dependents and a history of 136 other CVEs, and the flaw lets a normal, low-privileged workflow user defeat the exact control an admin configured to keep agent actions safe and compliant — undermining trust boundaries in agentic automation rather than requiring any special access. There is no CVSS score, EPSS data, or CISA KEV listing yet, and no public exploit code or Nuclei template has surfaced, so this is not being mass-exploited today, but the technique itself (crafting bypass text) requires no special tooling. Upgrade to n8n 2.10.0 or later immediately; until patched, treat the Guardrail node as advisory rather than a hard security boundary, add independent output validation downstream of any agent using it, and audit workflow execution logs for inputs that correlate with guardrail-adjacent actions succeeding unexpectedly.

Is CVE-2026-56349 actively exploited?

No confirmed active exploitation of CVE-2026-56349 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56349?

Upgrade n8n to version 2.10.0 or later, which contains the fix per the vendor advisory (GHSA-fvfv-ppw4-7h2w). Until upgraded: do not rely on the Guardrail node as the sole safety control for agent workflows — add independent, redundant output validation or allowlisting outside n8n; restrict who can submit inputs to guardrail-protected workflows; review workflow execution logs for inputs that produced unexpected agent actions or outputs; monitor the vendor advisory and VulnCheck writeup for IOCs or refined exploitation detail as they emerge.

What systems are affected by CVE-2026-56349?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines, guardrail/moderation layers.

What is the CVSS score for CVE-2026-56349?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelinesguardrail/moderation layers

MITRE ATLAS Techniques

AML.T0051.000 Direct

AML.T0054 LLM Jailbreak

AML.T0065 LLM Prompt Crafting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM01:2025

What are the technical details?

Original Advisory

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

Exploitation Scenario

An attacker with normal, legitimate access to submit input to an n8n-orchestrated AI agent workflow (e.g., a customer-facing chatbot or internal support automation) crafts a specially formatted message designed to exploit the Guardrail node's input validation weakness. Because the node fails to correctly parse or evaluate this input against its configured guardrail rules, it passes the content through as if compliant, and the underlying AI agent processes the unfiltered instruction — executing an action, retrieving data, or generating output that the guardrail was specifically configured to block. The workflow owner has no indication the safety control was bypassed, since the node itself does not fail or alert.

Weaknesses (CWE)

CWE-20 Improper Input Validation CWE-20 Improper Input Validation

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.