CVE-2026-56353mediumCWE-287

CVE-2026-56353: falha de média gravidade em n8n

n8n - Authentication Bypass in Chat Trigger Node

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar n8n+ Monitorar n8n

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.3%
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
n8n · n8n
CVEs relacionadas — n8n

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59257MEDIUMn8n - SQL Injection in MySQL v1 executeQuery Operation via Expression InterpolationEPSS 0.6%CVE-2025-71380HIGHn8n - Arbitrary Command Execution via Execute Command NodeEPSS 0.6%CVE-2026-56348MEDIUMn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters EndpointEPSS 0.5%CVE-2026-56349MEDIUMn8n - Guardrail Node Bypass via Crafted InputEPSS 0.5%CVE-2026-59259MEDIUMn8n - Permission Bypass via Expression Parser Mismatch in External SecretsEPSS 0.4%CVE-2026-58661MEDIUMn8n - Disk Space Exhaustion via Data-Table File Upload EndpointEPSS 0.4%