CVE-2026-56775: n8n viewer role bypasses RBAC on

CISO Take

n8n's evaluation test-run endpoints check for the workflow:read scope where they should require workflow:execute, so on Enterprise/Cloud instances using Advanced Permissions a user holding only the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they were only supposed to view. This is a classic broken access control bug (CWE-863) rather than a novel AI attack, but n8n is widely used as an AI agent orchestration layer, so the blast radius is any team relying on evaluation runs to validate agent/workflow behavior before promotion — an over-permissioned viewer could quietly sabotage or erase that evidence trail. There's no EPSS data, it's not in CISA KEV, and no public exploit or Nuclei template exists, so this looks like an insider-risk / least-privilege gap rather than an internet-mass-exploitation concern; exploitation requires an authenticated account with at least project:viewer access (PR:L), and impact is capped at integrity/availability of test-run state (C:N/I:L/A:L, CVSS 5.4). CISOs running n8n Enterprise/Cloud with granular project roles should upgrade to 1.123.55, 2.25.7, or 2.26.2 and audit recent evaluation run cancellations/deletions performed by viewer-role accounts as a compensating detection step until patched.

Sources: NVD GitHub Advisory CISA KEV OpenSSF ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 5.4) with a narrow blast radius: exploitation requires an authenticated account with at least project:viewer role on an Advanced Permissions (Enterprise/Cloud) instance, so this is not exploitable by anonymous or unauthenticated attackers. Impact is limited to integrity and availability of evaluation test-run state (no confidentiality impact) — an over-privileged-by-mistake viewer can start, cancel, or delete eval runs, but cannot read or exfiltrate workflow data beyond what their read scope already permits. No EPSS score, no CISA KEV listing, no public exploit code or Nuclei template were found, and exploitation requires no special AI/ML expertise (trivial sophistication) — it's a straightforward API scope-check bug. The main real-world risk is insider abuse or a compromised low-privilege account being used to disrupt evaluation pipelines that gate AI agent workflow promotion, plus reputational/audit friction if eval history is deleted before an incident review. Given n8n's history of 123 other CVEs in the package and an OpenSSF Scorecard of 6.6/10, this fits a pattern of recurring authorization hygiene issues in the platform worth tracking rather than a one-off.

How does the attack unfold?

Precondition

Attacker holds or obtains an authenticated project:viewer role on an n8n Enterprise/Cloud instance using Advanced Permissions.

Exploitation

Attacker calls the evaluation test-run start/cancel/delete endpoints directly; the endpoints check for workflow:read scope instead of workflow:execute, so the read-only role passes authorization.

Impact

Attacker starts unauthorized evaluation runs, cancels legitimate in-flight runs, or deletes run records for workflows they can only read, disrupting AI agent workflow testing integrity and availability.

AML.T0029

Precondition

Attacker holds or obtains an authenticated project:viewer role on an n8n Enterprise/Cloud instance using Advanced Permissions.

Exploitation

Attacker calls the evaluation test-run start/cancel/delete endpoints directly; the endpoints check for workflow:read scope instead of workflow:execute, so the read-only role passes authorization.

Impact

Attacker starts unauthorized evaluation runs, cancels legitimate in-flight runs, or deletes run records for workflows they can only read, disrupting AI agent workflow testing integrity and availability.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
201.9K OpenSSF 6.7 Pushed today 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A Low

What should I do?

1 step

Patch to n8n 1.123.55 (1.x line), 2.25.7, or 2.26.2, whichever branch is in use — the fix corrects the scope check on the three affected endpoints to require workflow:execute instead of workflow:read. Until patched, review and tighten project:viewer role assignments on Enterprise/Cloud instances using Advanced Permissions, and treat viewer as equivalent to execute-capable for evaluation runs when assigning roles. Detection: audit application/API logs for evaluation test-run start/cancel/delete calls originating from accounts that hold only project:viewer role on the associated workflow, and flag any evaluation run deletions that don't correlate with an execute-scoped user. Reference the vendor advisory (GHSA-664h-gpgq-h6xx) and VulnCheck write-up for exact endpoint names when building the log query.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6 - Internal organization / roles and responsibilities for AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56775?

n8n's evaluation test-run endpoints check for the workflow:read scope where they should require workflow:execute, so on Enterprise/Cloud instances using Advanced Permissions a user holding only the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they were only supposed to view. This is a classic broken access control bug (CWE-863) rather than a novel AI attack, but n8n is widely used as an AI agent orchestration layer, so the blast radius is any team relying on evaluation runs to validate agent/workflow behavior before promotion — an over-permissioned viewer could quietly sabotage or erase that evidence trail. There's no EPSS data, it's not in CISA KEV, and no public exploit or Nuclei template exists, so this looks like an insider-risk / least-privilege gap rather than an internet-mass-exploitation concern; exploitation requires an authenticated account with at least project:viewer access (PR:L), and impact is capped at integrity/availability of test-run state (C:N/I:L/A:L, CVSS 5.4). CISOs running n8n Enterprise/Cloud with granular project roles should upgrade to 1.123.55, 2.25.7, or 2.26.2 and audit recent evaluation run cancellations/deletions performed by viewer-role accounts as a compensating detection step until patched.

Is CVE-2026-56775 actively exploited?

No confirmed active exploitation of CVE-2026-56775 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56775?

Patch to n8n 1.123.55 (1.x line), 2.25.7, or 2.26.2, whichever branch is in use — the fix corrects the scope check on the three affected endpoints to require workflow:execute instead of workflow:read. Until patched, review and tighten project:viewer role assignments on Enterprise/Cloud instances using Advanced Permissions, and treat viewer as equivalent to execute-capable for evaluation runs when assigning roles. Detection: audit application/API logs for evaluation test-run start/cancel/delete calls originating from accounts that hold only project:viewer role on the associated workflow, and flag any evaluation run deletions that don't correlate with an execute-scoped user. Reference the vendor advisory (GHSA-664h-gpgq-h6xx) and VulnCheck write-up for exact endpoint names when building the log query.

What systems are affected by CVE-2026-56775?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-56775?

CVE-2026-56775 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

Exploitation Scenario

An internal user (or an attacker who has compromised low-privilege credentials) is granted project:viewer access to a workflow project on an n8n Enterprise/Cloud instance so they can review AI agent workflows for audit or onboarding purposes. Instead of only viewing evaluation results, they call the evaluation test-run API directly with their existing session — the endpoint checks for workflow:read scope, which their viewer role satisfies, rather than the intended workflow:execute scope. They use this to trigger unauthorized test runs (consuming compute/API budget or exercising the AI agent against unintended inputs), cancel a legitimate in-flight evaluation started by an engineer, or delete run records to hide evidence of a failed or malicious test, all without ever having been granted execute permission on the workflow.

Weaknesses (CWE)

CWE-863 Incorrect Authorization CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.