Is there a patch available for CVE-2026-56349?

Yes, a patch is available for CVE-2026-56349. Update the affected software to the latest version immediately.

n8n CVE-2026-56349

Q: What is the CVSS score of CVE-2026-56349?

CVE-2026-56349 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44624 MEDIUM

Improper Input Validation (CWE-20)

2026-07-15 VulnCheck

GHSA-9v3h-fx77-8r29

Authentication Bypass N8n

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network vector confirmed; no auth required for end-user input; crafting bypass input is low complexity; integrity-only impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 12:39 vuln.today

Analysis Generated

Jul 15, 2026 - 12:39 vuln.today

DescriptionCVE.org

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

AnalysisAI

Input validation bypass in n8n's Guardrail node (versions before 2.10.0) allows end users interacting with affected workflows to circumvent AI safety guardrail instructions through crafted inputs, undermining workflow integrity. Any n8n deployment running a workflow that incorporates the Guardrail node is exposed; instances not using that node are entirely unaffected regardless of version. No public exploit code has been identified and this CVE does not appear in CISA KEV; a vendor-confirmed patch is available in n8n 2.10.0.

Technical ContextAI

n8n is an open-source, self-hosted workflow automation platform distributed as the npm package 'n8n' (CPE: cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*). The Guardrail node is a dedicated workflow component designed to enforce AI content safety policies - it evaluates end-user inputs against a set of administrator-configured instructions before allowing them to proceed through the workflow. The root cause is CWE-20 (Improper Input Validation): the Guardrail node fails to adequately normalize or reject crafted inputs that are structured to evade pattern-based or prompt-based instruction matching. This class of vulnerability is common in AI safety layers that rely on natural-language instruction matching rather than robust allow-list or semantic validation, making them susceptible to prompt-injection-style bypass techniques at the workflow input boundary.

RemediationAI

The primary remediation is to upgrade n8n to version 2.10.0 or later; this is a vendor-released patch confirmed by both the GitHub Security Advisory GHSA-fvfv-ppw4-7h2w and upstream commit 8d0251d1deef256fd3d9176f05dedab62afde918 (https://github.com/n8n-io/n8n/commit/8d0251d1deef256fd3d9176f05dedab62afde918). If immediate upgrade is not possible, the vendor recommends restricting access to workflows that use the Guardrail node to trusted users only - this reduces the attacker pool but does not eliminate bypass risk from insider or compromised accounts, and is explicitly noted as an incomplete mitigation. Administrators should also audit existing workflows to assess whether a guardrail bypass in their specific use case has material security consequences, and consider redesigning those workflows to enforce safety controls at a layer beyond the Guardrail node alone (e.g., output validation at the API consumer level) as an additional compensating control with the trade-off of added engineering overhead.