CVE-2026-56353

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw	Vendor Advisory
https://www.vulncheck.com/advisories/n8n-authentication-bypass-in-chat-trigger-node	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n::::::node.js::*
	cpe:2.3:a:n8n:n8n::::::node.js::*
	cpe:2.3:a:n8n:n8n:2.10.0::::community:node.js::*
	cpe:2.3:a:n8n:n8n:2.10.0::::enterprise:node.js::*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) n8n contiene una omisión de autenticación en el nodo Chat Trigger cuando se configura con n8n User Auth (una configuración no predeterminada). En las versiones afectadas - antes de la 1.123.22, la línea 2.0.0 a 2.9.2, y la 2.10.0 - la verificación de autenticación en el endpoint de webhook de Chat Trigger puede ser eludida, permitiendo el acceso sin credenciales válidas. Corregido en 1.123.22, 2.9.3, y 2.10.1.

Information

Published : 2026-07-15 12:18

Updated : 2026-10-24 22:10

NVD link : CVE-2026-56353

Mitre link : CVE-2026-56353

CVE.ORG link : CVE-2026-56353

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-56353", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56353", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T15:13:06.303735Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.22", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.22", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.9.3", "versionType": "semver"}, {"status": "unaffected", "version": "2.9.3", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.10.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.10.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-07-15T12:18:02.580", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-authentication-bypass-in-chat-trigger-node", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases \u2014 before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 \u2014 the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1."}, {"lang": "es", "value": "n8n contiene una omisi\u00f3n de autenticaci\u00f3n en el nodo Chat Trigger cuando se configura con n8n User Auth (una configuraci\u00f3n no predeterminada). En las versiones afectadas - antes de la 1.123.22, la l\u00ednea 2.0.0 a 2.9.2, y la 2.10.0 - la verificaci\u00f3n de autenticaci\u00f3n en el endpoint de webhook de Chat Trigger puede ser eludida, permitiendo el acceso sin credenciales v\u00e1lidas. Corregido en 1.123.22, 2.9.3, y 2.10.1."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "77E36F68-2FDD-4771-B2DD-3F0A168E92E1", "versionEndExcluding": "1.123.22"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CDB18D4D-1D4C-422A-BE3E-0FF8FC9DDD82", "versionEndExcluding": "2.9.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.10.0:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B665A0E7-0DC8-4B25-9D16-BA3B2CBFB12C"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.10.0:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B30DD229-9AF2-4E3D-B1BC-C6014B510ADE"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}