CVE-2026-56778: n8n Public API Authorization Bypass in Execution Retry

Technical summary

The authorization bypass exists in the Public API's execution retry endpoint. The endpoint validates incoming requests against the workflow:read scope rather than the workflow:execute scope. In a properly designed system, reading a workflow and executing it are separate permissions; a user granted read access should not gain execution capability. The vulnerability allows an authenticated API caller with only read-level credentials to invoke the retry mechanism, effectively executing workflow logic without holding the required execute permission. This is classified as an authorization bypass (CWE-863: Improper Authorization) and has a CVSS v3.1 score of 6.4 (Medium), reflecting network-based attack surface, low attack complexity, and the ability to modify workflow outcomes or access sensitive data during execution.

Business impact

Organizations using n8n for workflow automation may face unintended workflow executions triggered by users who should have limited access. In environments where workflows handle sensitive operations—data processing, external API calls, financial transactions, or credential management—unauthorized retries could alter outcomes, leak data, or trigger unintended side effects. The impact is heightened in multi-tenant or cross-project deployments where access controls are relied upon to prevent privilege escalation. A read-only analyst, for example, could retry a workflow that sends emails, modifies records, or queries restricted systems, undermining governance and audit trails.

Affected systems

The vulnerability affects n8n instances running any version before 2.25.7 and any 2.26.x release before 2.26.2. Any deployment where workflows are shared between users or across projects—particularly those relying on granular API-level access controls to separate read from execute permissions—is in scope. Self-hosted and cloud-hosted n8n instances are both affected if they have not been patched to the specified versions.

Exploitability

Exploitability is moderate. An attacker must be an authenticated user within the n8n instance with at least read access to a workflow (a common scenario in shared environments). No special privileges are required; standard API authentication suffices. The attack requires no user interaction and can be automated programmatically via the Public API. However, the attacker must know or enumerate workflow IDs and must already be granted access to view the target workflow. The barrier to exploitation is low once those preconditions are met.

Remediation

Upgrade immediately to n8n version 2.25.7 or later (if on the 2.25.x branch) or to version 2.26.2 or later (if on the 2.26.x branch). Verify against the vendor advisory for any additional patched branches. After patching, the authorization check for the execution retry endpoint will correctly validate the workflow:execute scope, preventing read-only users from triggering retries. Organizations should also audit Public API usage logs to identify any unauthorized retry attempts that may have occurred prior to patching.

Patch guidance

Apply the relevant security update: upgrade to n8n 2.25.7 or n8n 2.26.2 or later. For instances on other release branches, verify the vendor advisory to confirm whether patches are available. Test the upgrade in a staging environment first to ensure compatibility with custom workflows and integrations. After deployment, confirm that existing read-only API credentials can no longer trigger the retry endpoint, and verify that users with execute permissions retain that capability. Document the patch date and scope for compliance records.

Detection guidance

Monitor Public API logs for retry endpoint calls from accounts or API keys that lack workflow:execute permissions but hold only workflow:read scope. Look for patterns of retry activity initiated by users or service accounts not expected to trigger executions. In n8n's audit logs, search for execution retry events and cross-reference them with the initiating user's permission level. Check for any retries of sensitive workflows (data exports, credential operations, external integrations) initiated by non-privileged users. Consider implementing alerting rules for any execution retry requests from read-only accounts.

Why prioritize this

Although rated CVSS 6.4 (Medium), this vulnerability merits prompt attention because it directly undermines access control boundaries in automation platforms. n8n is often trusted to handle sensitive workflows involving data, credentials, and external systems. An authenticated user bypassing execute restrictions can trigger unintended business logic or data operations, potentially with compliance implications. The relative ease of exploitation (requiring only valid credentials and API access) and the high functional impact in typical n8n deployments justify prioritization ahead of many other Medium-severity issues.

Risk score, explained

The CVSS 6.4 score reflects: (1) network-accessible attack surface (Public API), (2) low attack complexity (standard API call), (3) requirement for low privileges (read-only account suffices), (4) no user interaction needed, (5) scope change (the retry affects the workflow's execution context, not just the caller's context), and (6) moderate confidentiality and integrity impact (unauthorized execution of workflow logic can leak data or alter state). The score does not include integrity or confidentiality impact at the system level, which is why it remains Medium rather than High; however, the functional impact in real deployments may exceed the base score if workflows are high-value or handle sensitive data.

Frequently asked questions