CVE-2026-56352: n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter
n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8NRESTRICTFILEACCESSTO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.19.3 - Compensating control
Restrict access to the n8n REST API so only trusted users/systems can authenticate with permissions to create/modify workflows (since authenticated users with those permissions can reach the vulnerable ExecuteWorkflow localFile parameter and bypass N8N_RESTRICT_FILE_ACCESS_TO).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56352?
The severity of CVE-2026-56352 is classified as medium with a score of 5.3.
How do I fix CVE-2026-56352?
To fix CVE-2026-56352, upgrade n8n to version 2.19.3 or later, which addresses the file path restriction bypass.
What is the risk associated with CVE-2026-56352?
CVE-2026-56352 has a risk score of 39, indicating a significant potential threat.
What type of vulnerability is CVE-2026-56352?
CVE-2026-56352 is a path traversal vulnerability allowing arbitrary file read and execution.
Which versions of n8n are affected by CVE-2026-56352?
n8n versions before 2.19.3 are affected by CVE-2026-56352.