CVE-2026-56353: n8n - Authentication Bypass in Chat Trigger Node
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.22 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.9.3 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.10.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56353?
The severity of CVE-2026-56353 is rated as medium with a score of 6.3.
How do I fix CVE-2026-56353?
To fix CVE-2026-56353, upgrade n8n to versions 1.123.22 or later, or 2.10.1 or later.
What is affected in CVE-2026-56353?
CVE-2026-56353 affects the Chat Trigger node in n8n when configured with n8n User Auth prior to the specified versions.
What is the risk of CVE-2026-56353?
The risk of CVE-2026-56353 is classified as 37, indicating a significant potential impact due to authentication bypass.
When was CVE-2026-56353 published?
CVE-2026-56353 was published on July 15, 2026.