CVE-2026-56354: n8n Form Node XSS and Open Redirect Vulnerabilities

Technical summary

The Form Node in n8n fails to properly sanitize user-supplied HTML in description fields, creating a stored XSS vulnerability (CWE-79). Additionally, the iframe sandbox attribute is configured with insufficient restrictions, allowing injected content to perform navigation actions and bypass intended security boundaries. Because the vulnerability requires prior authentication and workflow creation privileges, the attack surface is limited to internal users or those with delegated workflow authoring rights. The impact manifests when end users interact with affected forms—malicious JavaScript executes in their security context, or they are silently redirected via unvalidated parameters embedded in the form configuration.

Business impact

For organizations using n8n to build customer-facing or internal workflows, this vulnerability creates a supply-chain risk within your own automation layer. A malicious insider or compromised account with workflow creation permissions can poisone forms that hundreds or thousands of end users interact with daily. Impacts include credential theft (phishing redirects), session hijacking via XSS, malware distribution, or reputational damage if customers are redirected to fraudulent sites. The stored nature of the attack means the malicious payload persists until the affected workflow is manually reviewed and remediated.

Affected systems

n8n deployments running versions 1.x prior to 1.123.24, 2.x prior to 2.10.4, and the 2.12.0 branch (until patched in a later version) are affected. Both self-hosted and cloud-hosted n8n instances are impacted if running vulnerable versions. The vulnerability is limited to workflows utilizing the Form Node and requires an authenticated user with workflow creation or editing permissions to introduce the payload.

Exploitability

Exploitation requires valid n8n credentials and workflow creation privileges—this is not an unauthenticated or zero-click attack. However, within an organization where multiple users author workflows, the barrier to entry is moderate. Once a malicious form is published, it affects all downstream users with no additional interaction required from the attacker. The CVSS score of 4.1 (Medium) reflects the authentication requirement and limited scope, but understates business risk if your threat model includes insider threats or account compromise.

Remediation

Upgrade n8n to version 1.123.24 or later on the 1.x branch, or 2.10.4 or later on the 2.x branch (verify the exact patched version for your branch against the vendor advisory). The patches implement proper HTML sanitization in Form Node description fields and enforce stricter iframe sandbox policies. Organizations unable to patch immediately should restrict workflow creation permissions to trusted administrators and conduct a manual audit of existing Form Nodes for suspicious description fields or redirect parameters.

Patch guidance

Check your current n8n version via the Admin panel or deployment logs. For self-hosted instances, update via your deployment method (Docker Compose, Kubernetes, etc.) to the patched version. For cloud-hosted n8n, contact support to confirm your instance is running a patched version—some cloud providers auto-update, but verify explicitly. After patching, restart or redeploy the n8n service to activate security improvements. Test workflow execution to ensure no breakage; the patches target sanitization and sandbox policy and should not affect legitimate form functionality.

Detection guidance

Review audit logs for Form Node creation or modification events, particularly those adding or changing HTML content in description fields. Look for suspicious patterns: script tags, event handlers (onerror, onload), or unusual iframe attributes in form definitions. If you have access to the n8n database or workflow export, search workflow JSON for Form Nodes containing '<script>', 'javascript:', or 'iframe' with permissive sandbox values. Monitor end-user reports of unexpected redirects or script errors after interacting with forms. Browser developer tools (Network tab) will show if users are being redirected to off-domain URLs after form submission.

Why prioritize this

Although the CVSS score is moderate (4.1), the stored XSS and redirect capabilities pose a material integrity and compliance risk, especially in regulated industries. The attack chain—credential compromise or insider threat → malicious workflow creation → mass user exposure—is plausible and leaves minimal forensic evidence if the workflow is later deleted. Prioritize patching in instances where workflows are visible to external customers or large internal user bases. Patch within 30 days for standard risk posture; expedite to 7-14 days if you operate customer-facing automation.

Risk score, explained

The CVSS v3.1 score of 4.1 (Medium) accounts for: network accessibility (no local access required), low attack complexity, required authentication and privileges (significant mitigating factors), and limited impact scope (integrity only, no confidentiality or availability impact from the vulnerability itself). However, the score does not fully reflect organizational risk if insider threat or account compromise is a concern in your threat model, nor does it account for the reputational impact of customer-facing forms being weaponized. Use this score as a baseline but contextualize it against your specific deployment and user landscape.

Frequently asked questions