CVE-2026-56354mediumCWE-79

CVE-2026-56354: fallo de gravedad media en n8n

n8n - Cross-Site Scripting and Open Redirect in Form Node

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear n8n+ Monitorear n8n

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.2%
n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
n8n · n8n
CVEs relacionadas — n8n

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-59257MEDIUMn8n - SQL Injection in MySQL v1 executeQuery Operation via Expression InterpolationEPSS 0.6%CVE-2025-71380HIGHn8n - Arbitrary Command Execution via Execute Command NodeEPSS 0.6%CVE-2026-56348MEDIUMn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters EndpointEPSS 0.5%CVE-2026-56349MEDIUMn8n - Guardrail Node Bypass via Crafted InputEPSS 0.5%CVE-2026-59259MEDIUMn8n - Permission Bypass via Expression Parser Mismatch in External SecretsEPSS 0.4%CVE-2026-58661MEDIUMn8n - Disk Space Exhaustion via Data-Table File Upload EndpointEPSS 0.4%