CVE-2026-56776: n8n workflow:read scope bypass

CISO Take

n8n's evaluation test-run endpoint checks a workflow's read scope instead of its execute scope, so any authenticated user granted read-only access to a workflow — a common least-privilege RBAC assignment for auditors, contractors, or junior team members — can trigger a genuine execution of that workflow through the internal runner. Because n8n is widely deployed as the orchestration layer for AI agent pipelines wiring LLMs into CRMs, payment systems, and internal APIs, an attacker with nothing more than viewer access can force real outbound calls and data mutations in every system that workflow touches. There's no evidence of active exploitation — the CVE isn't in CISA KEV, no public exploit or Nuclei template exists, and EPSS scoring isn't yet available — but the flaw requires no user interaction and low attack complexity, and n8n already carries a middling risk profile (OpenSSF Scorecard 6.6/10, package risk score 69/100, 123 other disclosed CVEs), so it sits in a component with a track record of security gaps. Patch to n8n 1.123.55, 2.25.7, or 2.26.2 immediately; until then, audit every RBAC project role granting workflow:read on workflows tied to the Evaluations feature and treat that access as equivalent to execute for connected downstream systems.

Sources: NVD GitHub Advisory VulnCheck CISA KEV ATLAS OpenSSF

What is the risk?

High-severity (CVSS 7.4) authorization bypass with network attack vector, low complexity, and no user interaction — the technical bar to exploit is trivial for anyone who already holds any authenticated account with read-only project access. The scope-changed vector (S:C) reflects that impact extends beyond the vulnerable component itself into whatever systems the workflow's nodes connect to (APIs, databases, messaging, payment). There is no CISA KEV listing, no public exploit code, and no Nuclei template, and EPSS is not yet scored, so exploitation-in-the-wild likelihood is currently low — but this is a logic flaw (CWE-863, incorrect authorization) that any user already inside the system can trigger without special tooling, making insider risk and detection gaps the primary concern rather than internet-scale scanning.

How does the attack unfold?

Read-only access grant

An attacker or insider (e.g., contractor, auditor) holds a legitimate but restricted n8n project role with workflow:read access to a target workflow.

AML.T0012

Scope-bypass API call

The attacker calls POST /workflows/{workflowId}/test-runs/new; the endpoint incorrectly authorizes the request based on workflow:read instead of requiring workflow:execute.

Real workflow execution

n8n's internal workflow runner executes the full workflow for real, invoking every connected node/tool exactly as an authorized execute-permission run would.

AML.T0053

Unintended downstream impact

Connected systems receive unauthorized outbound API calls, data mutations, or side effects (billing, CRM writes, webhooks) triggered by a user who was never granted execute rights.

AML.T0048

Read-only access grant

An attacker or insider (e.g., contractor, auditor) holds a legitimate but restricted n8n project role with workflow:read access to a target workflow.

AML.T0012

Scope-bypass API call

The attacker calls POST /workflows/{workflowId}/test-runs/new; the endpoint incorrectly authorizes the request based on workflow:read instead of requiring workflow:execute.

Real workflow execution

n8n's internal workflow runner executes the full workflow for real, invoking every connected node/tool exactly as an authorized execute-permission run would.

AML.T0053

Unintended downstream impact

Connected systems receive unauthorized outbound API calls, data mutations, or side effects (billing, CRM writes, webhooks) triggered by a user who was never granted execute rights.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
201.9K OpenSSF 6.7 Pushed today 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I Low

A Low

What should I do?

1 step

1) Upgrade immediately to n8n 1.123.55, 2.25.7, or 2.26.2, which fix the scope check. 2) Until patched, audit all project roles and revoke or downgrade workflow:read grants on any workflow tied to Evaluations, or disable the Evaluations feature on instances that can't patch immediately. 3) Treat workflow:read as equivalent to workflow:execute in your risk model for any workflow connected to sensitive downstream systems (payment, email, data stores) and restrict such workflows to admin/owner roles. 4) Detection: monitor execution logs for test-run invocations from accounts that should only have read access, and alert on test-run triggers outside expected QA/evaluation windows. 5) Review GHSA-hv7x-3x78-gx53 and the VulnCheck advisory for updated detection guidance.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN-1.5 - Ongoing monitoring and periodic review of risk management processes, including roles, responsibilities, and authorities

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56776?

n8n's evaluation test-run endpoint checks a workflow's read scope instead of its execute scope, so any authenticated user granted read-only access to a workflow — a common least-privilege RBAC assignment for auditors, contractors, or junior team members — can trigger a genuine execution of that workflow through the internal runner. Because n8n is widely deployed as the orchestration layer for AI agent pipelines wiring LLMs into CRMs, payment systems, and internal APIs, an attacker with nothing more than viewer access can force real outbound calls and data mutations in every system that workflow touches. There's no evidence of active exploitation — the CVE isn't in CISA KEV, no public exploit or Nuclei template exists, and EPSS scoring isn't yet available — but the flaw requires no user interaction and low attack complexity, and n8n already carries a middling risk profile (OpenSSF Scorecard 6.6/10, package risk score 69/100, 123 other disclosed CVEs), so it sits in a component with a track record of security gaps. Patch to n8n 1.123.55, 2.25.7, or 2.26.2 immediately; until then, audit every RBAC project role granting workflow:read on workflows tied to the Evaluations feature and treat that access as equivalent to execute for connected downstream systems.

Is CVE-2026-56776 actively exploited?

No confirmed active exploitation of CVE-2026-56776 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56776?

1) Upgrade immediately to n8n 1.123.55, 2.25.7, or 2.26.2, which fix the scope check. 2) Until patched, audit all project roles and revoke or downgrade workflow:read grants on any workflow tied to Evaluations, or disable the Evaluations feature on instances that can't patch immediately. 3) Treat workflow:read as equivalent to workflow:execute in your risk model for any workflow connected to sensitive downstream systems (payment, email, data stores) and restrict such workflows to admin/owner roles. 4) Detection: monitor execution logs for test-run invocations from accounts that should only have read access, and alert on test-run triggers outside expected QA/evaluation windows. 5) Review GHSA-hv7x-3x78-gx53 and the VulnCheck advisory for updated detection guidance.

What systems are affected by CVE-2026-56776?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

What is the CVSS score for CVE-2026-56776?

CVE-2026-56776 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN-1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.

Exploitation Scenario

A contractor or junior analyst is given read-only access to a production n8n workflow so they can review its logic without being able to run it — a standard least-privilege pattern. That user calls POST /workflows/{workflowId}/test-runs/new directly against the API using their existing session or API key. Because the endpoint only checks workflow:read, the request is authorized, and n8n's internal workflow runner executes the workflow for real — not as a sandboxed dry-run. If the workflow is part of an AI agent pipeline that calls a paid LLM API, posts to Slack, writes records to a CRM, or triggers a payment webhook, all of those actions fire as if an authorized operator had intentionally executed the workflow, with no execute-level audit trail to distinguish it from a legitimate run.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.