Is there a public PoC exploit available for CVE-2026-56350?

Yes, a public proof-of-concept exploit is available for CVE-2026-56350. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-56350?

Yes, a patch is available for CVE-2026-56350. Update the affected software to the latest version immediately.

n8n CVE-2026-56350

Q: What is the CVSS score of CVE-2026-56350?

CVE-2026-56350 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40443 MEDIUM

Improper Authorization (CWE-285)

2026-06-30 VulnCheck

GHSA-j7c2-5x6r-g9w8

Authentication Bypass N8n

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-exploitable via API with any SSO session (PR:L); no user interaction; integrity-only impact as auth policy is modified, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:36 vuln.today

DescriptionCVE.org

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

AnalysisAI

SSO enforcement bypass in n8n before 2.8.0 allows any authenticated SSO user to disable organization-wide SSO enforcement via the API, then register a local password credential, permanently decoupling their account from the identity provider. This defeats identity-provider-enforced MFA and enables persistent access that survives SSO policy changes or user deprovisioning in the IdP. No public exploit code has been identified at time of analysis, but the technique requires only a valid SSO session and knowledge of the relevant API endpoint.

Technical ContextAI

n8n is a source-available workflow automation platform (cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*) that supports Single Sign-On as an enterprise authentication method. The vulnerability is classified as CWE-285 (Improper Authorization), meaning the application fails to correctly verify that the requesting user has the authorization to perform the 'disable SSO enforcement' operation on the API. A correctly implemented control would require administrator privileges to modify authentication-mode settings; n8n before 2.8.0 permits any authenticated SSO user to invoke this privileged API action. The root cause is a missing or insufficient privilege check on an API endpoint that modifies global authentication policy, not a flaw in the SSO protocol itself.

RemediationAI

The primary fix is to upgrade n8n to version 2.8.0 or later, which is the confirmed remediation boundary per the vendor security advisory GHSA-vjf3-2gpj-233v at https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v. Organizations that cannot immediately upgrade should audit existing user accounts for unexpected local password credentials that may have been created via this bypass - any local credential on an account that should be SSO-only is a sign of prior exploitation. As a compensating control, restrict API access to the n8n instance at the network perimeter to prevent untrusted SSO users from reaching the authentication-settings endpoint; note this trade-off is that legitimate API automation may also be disrupted. Review n8n audit logs for API calls that modified authentication configuration. After patching, re-enable and verify SSO enforcement is active and that no local credentials persist for SSO-managed accounts.