CVE-2026-56353: n8n auth bypass — MEDIUM

CISO Take

n8n's Chat Trigger node — the entry point that lets external callers kick off an AI agent workflow via webhook — has a logic flaw that lets an attacker bypass n8n's User Auth check on that endpoint, but only when the org has opted into that non-default auth mode. A CVSS of 4.8 with high attack complexity and no known public exploit or Nuclei template means this isn't a smash-and-grab, but n8n is a widely deployed workflow-automation platform (136 other CVEs in this package, OpenSSF Scorecard 6.6/10, 16 tracked downstream dependents) and Chat Trigger endpoints are frequently the front door to internal AI agents wired into email, CRMs, or internal APIs. It's not in CISA KEV and EPSS data isn't available, so treat this as a patch-now-not-panic item rather than a breaking alert. Upgrade to n8n 1.123.22, 2.9.3, or 2.10.1, and in the meantime audit any Chat Trigger node configured with n8n User Auth to confirm it isn't internet-exposed without a compensating control (reverse-proxy auth, IP allowlist, or WAF rule) in front of it.

Sources: NVD GitHub Advisory OpenSSF vulncheck.com ATLAS

What is the risk?

Medium severity (CVSS 4.8) driven down by high attack complexity — the flaw only manifests in the non-default n8n User Auth configuration for the Chat Trigger node, and confidentiality/integrity impact is limited (C:L/I:L, A:N). No EPSS score, no CISA KEV listing, no public exploit code or Nuclei template have surfaced, so real-world exploitation likelihood is currently low. The elevated concern is contextual: n8n's own package risk score sits at 69/100 with an OpenSSF Scorecard of 6.6/10 and a long history of prior CVEs (136), indicating a package worth monitoring closely rather than a one-off issue.

How does the attack unfold?

Initial Access

Attacker locates an internet-exposed n8n Chat Trigger webhook configured with n8n User Auth.

AML.T0049

Auth Bypass

Attacker sends a crafted request that circumvents the flawed authentication check on the webhook endpoint.

AML.T0107

Agent Interaction

Attacker converses with the AI agent workflow and invokes any connected tools or data sources without valid credentials.

AML.T0053

Impact

Attacker gains limited unauthorized access to workflow-connected data or triggers unintended automated actions.

AML.T0085

Initial Access

Attacker locates an internet-exposed n8n Chat Trigger webhook configured with n8n User Auth.

AML.T0049

Auth Bypass

Attacker sends a crafted request that circumvents the flawed authentication check on the webhook endpoint.

AML.T0107

Agent Interaction

Attacker converses with the AI agent workflow and invokes any connected tools or data sources without valid credentials.

AML.T0053

Impact

Attacker gains limited unauthorized access to workflow-connected data or triggers unintended automated actions.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
205.4K OpenSSF 6.7 Pushed 2d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

Patch to n8n 1.123.22 (pre-2.x line), 2.9.3, or 2.10.1 immediately. Until patched, audit all Chat Trigger nodes configured with n8n User Auth and verify webhook endpoints are not directly internet-facing without an additional layer of authentication (reverse proxy basic auth, mTLS, IP allowlisting, or WAF rule blocking unauthenticated access to /webhook/ chat-trigger paths). Review n8n execution logs for anomalous or unauthenticated invocations of chat-trigger workflows during the exposure window, and rotate any credentials accessible to affected agent workflows if suspicious activity is found.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - Security controls for AI system operation

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56353?

n8n's Chat Trigger node — the entry point that lets external callers kick off an AI agent workflow via webhook — has a logic flaw that lets an attacker bypass n8n's User Auth check on that endpoint, but only when the org has opted into that non-default auth mode. A CVSS of 4.8 with high attack complexity and no known public exploit or Nuclei template means this isn't a smash-and-grab, but n8n is a widely deployed workflow-automation platform (136 other CVEs in this package, OpenSSF Scorecard 6.6/10, 16 tracked downstream dependents) and Chat Trigger endpoints are frequently the front door to internal AI agents wired into email, CRMs, or internal APIs. It's not in CISA KEV and EPSS data isn't available, so treat this as a patch-now-not-panic item rather than a breaking alert. Upgrade to n8n 1.123.22, 2.9.3, or 2.10.1, and in the meantime audit any Chat Trigger node configured with n8n User Auth to confirm it isn't internet-exposed without a compensating control (reverse-proxy auth, IP allowlist, or WAF rule) in front of it.

Is CVE-2026-56353 actively exploited?

No confirmed active exploitation of CVE-2026-56353 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56353?

Patch to n8n 1.123.22 (pre-2.x line), 2.9.3, or 2.10.1 immediately. Until patched, audit all Chat Trigger nodes configured with n8n User Auth and verify webhook endpoints are not directly internet-facing without an additional layer of authentication (reverse proxy basic auth, mTLS, IP allowlisting, or WAF rule blocking unauthenticated access to `/webhook/` chat-trigger paths). Review n8n execution logs for anomalous or unauthenticated invocations of chat-trigger workflows during the exposure window, and rotate any credentials accessible to affected agent workflows if suspicious activity is found.

What systems are affected by CVE-2026-56353?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation.

What is the CVSS score for CVE-2026-56353?

CVE-2026-56353 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.

Exploitation Scenario

An attacker fingerprints an internet-exposed n8n instance and identifies a Chat Trigger webhook backing an internal AI support agent, configured with n8n User Auth. By sending a crafted request that exploits the flawed auth check on the webhook endpoint, the attacker bypasses the login requirement entirely and begins conversing directly with the agent — invoking whatever tools, APIs, or data sources the workflow has wired in (ticketing systems, internal knowledge bases, email) without ever presenting valid credentials, potentially extracting sensitive data or triggering unintended automated actions.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.