CVE-2026-56359: n8n OAuth2 XSS Vulnerability in Credential Management

Technical summary

The vulnerability exists in n8n's credential management flow where the OAuth2 Authorization URL field lacks sufficient input validation and output encoding. An authenticated attacker can inject JavaScript URLs (such as javascript: protocols or data: URIs) into this field. When a victim interacts with the OAuth authorization button, the injected script executes in their browser context with their session tokens and privileges. The attack surface is scoped to authenticated users with credential management capabilities, and successful exploitation requires social engineering or credential manipulation to trigger the victim's interaction.

Business impact

For organizations using n8n as a workflow automation platform, this vulnerability poses a session hijacking and data exfiltration risk. An insider or compromised account holder can create malicious credentials designed to steal session cookies, capture user input, or redirect users to phishing sites. In multi-user n8n deployments, shared credential libraries increase exposure. Compromised sessions grant attackers access to n8n automation workflows, connected integrations, and any data those workflows process or store. Remediation requires immediate patching and review of credential management logs for suspicious activity.

Affected systems

n8n installations running any version prior to 2.8.0 are affected. The vulnerability is specific to the credential management interface and affects any n8n deployment that allows authenticated users to create or modify OAuth2 credentials. Self-hosted and cloud-hosted n8n instances are both at risk if they have not been updated to version 2.8.0 or later.

Exploitability

Exploitability is moderate. The attack requires authenticated access to n8n and relies on social engineering or credential manipulation to succeed. An attacker cannot remotely trigger the XSS without user interaction; the victim must click the OAuth authorization button. However, the vector is network-accessible and the prerequisites are limited to authentication (PR:L). In environments where credential management is delegated to multiple users or where accounts are shared, the likelihood of successful exploitation increases. No public exploit code or active in-the-wild exploitation has been reported.

Remediation

Upgrade n8n to version 2.8.0 or later. This version includes fixes for input validation and output encoding in the credential management flow. For organizations unable to patch immediately, restrict credential management capabilities to trusted administrators, monitor credential creation and modification logs for suspicious patterns, and educate users not to interact with credentials from untrusted sources.

Patch guidance

Apply the update to n8n 2.8.0 or later as soon as possible. Verify compatibility with your current deployment configuration and any custom integrations before rolling out patches. For self-hosted instances, download and deploy the latest version from the official n8n repository. For cloud-hosted instances, coordinate with your n8n service provider to confirm patch deployment. Test the update in a staging environment first to ensure no workflow disruptions. After patching, review active sessions and credential configurations for any unauthorized modifications.

Detection guidance

Monitor n8n logs for credential creation or modification events that include URL-like patterns or JavaScript protocol handlers in credential fields. Look for unusual OAuth authorization button clicks or session activity immediately following credential access. Inspect credential management audit logs for modifications by unexpected users or at unusual times. Network-level detection can identify unusual redirect patterns or data exfiltration attempts from n8n sessions. Organizations should review recent credential management history prior to patching to identify potential compromise or testing by attackers.

Why prioritize this

While the CVSS score of 5.4 indicates medium severity, prioritize this patch within your standard maintenance window. The requirement for authentication and user interaction limits its exploitability, but the potential impact on session security and workflow integrity makes it material. Organizations with shared credential libraries or delegated credential management should treat this as higher priority.

Risk score, explained

The CVSS v3.1 score of 5.4 (MEDIUM) reflects the following factors: network-accessible vector (AV:N) with low attack complexity (AC:L), but requiring both authentication (PR:L) and user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability can affect resources outside the vulnerable component. Confidentiality and integrity impacts are low (C:L, I:L) because the attacker gains only the victim's session privileges, not direct access to the application's core data store. Availability is not impacted (A:N). The score appropriately captures that this is a session-scoped XSS rather than a system-wide compromise.

Frequently asked questions