CVE-2026-56776: n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56776?
CVE-2026-56776 has a high severity rating of 7.4.
How do I fix CVE-2026-56776?
To fix CVE-2026-56776, upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2 or later.
What is the risk associated with CVE-2026-56776?
CVE-2026-56776 poses a risk score of 52, indicating potential unauthorized access to sensitive workflow execution.
What does CVE-2026-56776 affect?
CVE-2026-56776 affects the n8n platform specifically concerning the OAuth scope validation in the workflow test run endpoint.
Who is affected by CVE-2026-56776?
Authenticated users with read-only access to workflows in n8n prior to the patched versions are affected by CVE-2026-56776.