CVE-2026-56776: n8n Authorization Bypass in Workflow Test Execution

Technical summary

The vulnerability exists in the POST /workflows/{workflowId}/test-runs/new endpoint, where authorization is incorrectly performed using the workflow:read permission scope instead of the required workflow:execute scope. An authenticated attacker with workflow:read permission can invoke this endpoint to trigger a genuine workflow execution through the internal workflow runner. Because the permission check validates against read access rather than execute access, the attacker's request passes authorization despite lacking execute privileges. The workflow then runs in the context of the authenticated user, executing all configured actions and integrations. This is particularly impactful in environments leveraging the Evaluations feature in conjunction with RBAC project roles that intentionally grant workflow:read without workflow:execute to enforce separation of duties.

Business impact

Organizations using n8n for workflow automation are at risk of unauthorized execution of business-critical processes. An attacker with read-only access—such as an analyst reviewing workflow logic or a contractor with limited permissions—can cause workflows to execute unintended API calls, modify data in connected systems, trigger notifications, or perform other side effects. In multi-tenant or highly controlled environments where RBAC is specifically configured to prevent certain users from executing workflows, this flaw completely undermines access governance. Downstream systems relying on workflows to maintain data integrity or audit trails may be affected without proper authorization trail context, complicating incident response and compliance reporting.

Affected systems

n8n before version 1.123.55 (in the 1.x branch) and before versions 2.25.7 and 2.26.2 (in the 2.x branches) are affected. The risk is highest for instances that use the Evaluations feature combined with RBAC project roles that intentionally restrict execute permissions while granting read permissions. Self-hosted and cloud-hosted n8n deployments running vulnerable versions are at risk if their access control model includes read-only user roles.

Exploitability

Exploitation requires valid authentication to the n8n instance, which is a low barrier for insider threats or compromised low-privilege credentials. The attack is trivial to execute—an authenticated user simply sends a POST request to the test-runs endpoint with a workflow ID they have read access to. No additional interaction, complex exploitation steps, or social engineering is needed. The attack surface is broad because any authenticated user with read permission on any workflow can attempt this. The CVSS score of 7.4 (HIGH) reflects the combination of network accessibility, low attack complexity, required authentication, and the cross-system impact from uncontrolled workflow execution.

Remediation

Upgrade n8n to a patched version: 1.123.55 or later for the 1.x branch, or 2.25.7 / 2.26.2 or later for the 2.x branches. The patch corrects the authorization logic to require workflow:execute scope instead of workflow:read. Organizations should prioritize patching instances that use RBAC with restrictive read-only roles, as these have the highest exposure. After patching, verify that workflows do not execute unexpectedly and that access control policies are correctly enforced.

Patch guidance

Review your current n8n version and apply the appropriate patch: if running 1.x, upgrade to 1.123.55 or later; if running 2.x, verify you are on 2.25.7, 2.26.2, or any later release in your branch. If using n8n Cloud, check with n8n support for upgrade status. If self-hosting, back up your workflows and configuration before upgrading. Test in a staging environment if possible to ensure workflow integrations function correctly post-patch. After patching, re-validate that user roles and workflow access permissions reflect your intended security posture.

Detection guidance

Review audit logs for POST requests to /workflows/*/test-runs/new endpoints initiated by users with read-only roles. Check the execution history of workflows for unexpected runs, particularly those triggered by users with lower privilege levels. If using RBAC, audit role assignments to identify users granted workflow:read without workflow:execute and cross-reference their recent activities. Monitor for unusual outbound API calls or data mutations that coincide with workflow test-run submissions from lower-privileged accounts. In logs, look for the test-run endpoint being called by non-admin users, especially if followed by workflow execution events.

Why prioritize this

This vulnerability directly undermines access control enforcement in workflow automation platforms. In environments where RBAC is specifically implemented to separate read and execute permissions, the flaw allows privilege escalation without requiring additional compromise. The low attack complexity and only requirement for valid authentication make it likely to be exploited by insiders or users with compromised low-privilege credentials. The impact spans multiple downstream systems through workflow execution, affecting confidentiality, integrity, and availability. Patching should be prioritized for organizations using n8n with strict access control policies.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) is justified by: network accessibility (AV:N) allowing any authenticated attacker to reach the endpoint; low attack complexity (AC:L) requiring only a standard API call; required authentication (PR:L) limiting risk to users with valid credentials; scope change (S:C) because workflow execution impacts not just n8n but downstream integrated systems; and multiple impact categories (C:L, I:L, A:L) covering confidentiality loss from unintended data access, integrity loss from unauthorized mutations, and availability impact from resource consumption or service disruption in connected systems.

Frequently asked questions