CVE-2026-56350: n8n SSO Bypass via API Authentication Flaw

Technical summary

The vulnerability stems from improper access control in n8n's API layer (CWE-285). Authenticated SSO users can invoke API endpoints that modify or disable SSO enforcement settings, then register local password-based credentials without triggering identity-provider validation. The attack requires valid SSO credentials but does not require administrative privileges, and results in the creation of accounts that authenticate outside the SSO boundary. The CVSS v3.1 score of 6.3 reflects the network-accessible API attack surface, low attack complexity once authenticated, and the integrity impact of policy bypass—though confidentiality and availability are not directly compromised.

Business impact

This vulnerability undermines the security model that many organizations rely on: centralized identity management and enforced MFA through SSO. An employee or contractor whose SSO account is compromised could be used to establish a local-only account that persists even after SSO credential revocation or MFA enrollment changes. This is particularly concerning for regulated industries where audit trails and identity-provider logs are relied upon for compliance. The ability to bypass MFA is a significant escalation in risk if combined with other network compromise or credential theft.

Affected systems

n8n deployments running any version prior to 2.8.0 that have SSO configured and user authentication enabled are affected. The vulnerability specifically impacts organizations using n8n's API access patterns; instances using only the web UI with SSO may have reduced exposure, but any authenticated API consumer (including service accounts or third-party integrations) could potentially exploit this if they have sufficient permission scopes.

Exploitability

Exploitation requires valid authenticated credentials (SSO or otherwise) and network access to the n8n instance's API endpoints. No user interaction or elevated privileges are required beyond possessing a valid login. While the CVSS attack complexity is rated High, reflecting that the attacker must understand API endpoints and SSO configuration, in practice this is well within reach of internal threat actors or external adversaries who have obtained any valid user credential. The lack of KEV status suggests this has not yet been leveraged at scale in active campaigns, but the relative ease of exploitation warrants rapid patching.

Remediation

Upgrade to n8n version 2.8.0 or later, which implements proper access control to prevent SSO enforcement bypass via the API. Verify against the official n8n release notes and security advisories to confirm patch availability for your deployment platform (cloud-hosted, self-managed, or Kubernetes). Simultaneously, review API access tokens and service accounts to audit whether any unauthorized local credentials have been created recently.

Patch guidance

1. Review your current n8n version and deployment architecture (cloud, self-hosted, containerized). 2. Consult the official n8n advisory and release notes for version 2.8.0 to identify any breaking changes or migration steps. 3. If self-hosted, prepare a test environment and validate the upgrade before production rollout. 4. If cloud-hosted, check whether your vendor has already applied the patch; if not, request a timeline. 5. After patching, restart any API consumer integrations and verify SSO enforcement is active by testing credential creation flows. 6. Monitor audit logs for any local account creation that predates the patch—this could indicate prior exploitation.

Detection guidance

Search your API access logs and audit trails for the following indicators: - Calls to SSO configuration or enforcement endpoints (API paths related to 'sso', 'auth', or 'settings') from non-administrative users. - Local user account creation by authenticated SSO users, especially followed by direct login attempts without SSO. - Abnormal or unexpected changes to authentication policies or MFA settings via API. - Discrepancies between your identity provider's audit log (showing credential validation) and n8n's local account creation timestamps. Implement alerting on these patterns if your n8n instance logs API activity to SIEM or similar tools.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt attention because it directly undermines identity and access control—a foundational security pillar. The combination of low authentication barrier (only requiring valid credentials, not admin role) and high-integrity impact (policy bypass and MFA evasion) makes it attractive to insider threats or lateral-movement attackers. Organizations with strict compliance requirements (SOC 2, ISO 27001, FedRAMP) should prioritize this as a control weakness. The 2-year age of the issue (published June 2026) means some deployments may still be unpatched.

Risk score, explained

The CVSS score of 6.3 (Medium) accurately reflects that this is a network-accessible, authenticated attack with significant integrity impact but no direct confidentiality or availability consequence. However, context matters: in environments where SSO and MFA are critical security controls, or where n8n handles sensitive workflow automation, the business risk may exceed the numeric score. Conversely, isolated or low-privilege n8n instances may carry lower operational risk. Organizations should layer this score with their own threat modeling and MFA dependency assessment.

Frequently asked questions