CVE-2026-56359: n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56359?
The severity of CVE-2026-56359 is medium with a score of 4.8.
How do I fix CVE-2026-56359?
To fix CVE-2026-56359, update n8n to version 2.8.0 or later.
What type of vulnerability is CVE-2026-56359?
CVE-2026-56359 is a Cross-Site Scripting (XSS) vulnerability.
Who can be affected by CVE-2026-56359?
Authenticated users of n8n can be affected by CVE-2026-56359 through malicious JavaScript URLs in OAuth2 Authorization fields.
What component of n8n does CVE-2026-56359 impact?
CVE-2026-56359 impacts the credential management flow within n8n.