CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

CVSS

No CVSS.

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w
https://www.vulncheck.com/advisories/n8n-guardrail-node-bypass-via-crafted-input

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) n8n antes de la versión 2.10.0 contiene una vulnerabilidad de validación de entrada en el nodo Guardrail que permite a los atacantes eludir las instrucciones predeterminadas de las barreras de seguridad. Los usuarios finales pueden crear entradas maliciosas para eludir las protecciones de las barreras de seguridad y comprometer la integridad del flujo de trabajo.

Information

Published : 2026-07-15 12:18

Updated : 2026-10-25 15:10

NVD link : CVE-2026-56349

Mitre link : CVE-2026-56349

CVE.ORG link : CVE-2026-56349

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-56349", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56349", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:42:50.947851Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "2.10.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.10.0", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-07-15T12:18:02.297", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-guardrail-node-bypass-via-crafted-input", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity."}, {"lang": "es", "value": "n8n antes de la versi\u00f3n 2.10.0 contiene una vulnerabilidad de validaci\u00f3n de entrada en el nodo Guardrail que permite a los atacantes eludir las instrucciones predeterminadas de las barreras de seguridad. Los usuarios finales pueden crear entradas maliciosas para eludir las protecciones de las barreras de seguridad y comprometer la integridad del flujo de trabajo."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}