CVE-2026-56353
Full vulnerability record from the local CVENow database.
Description
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-15 12:18:02.580000
Last modified
2026-10-24 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2026-56353",
"sourceIdentifier": "[email protected]",
"published": "2026-07-15T12:18:02.580",
"lastModified": "2026-10-24T22:10:00.210",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1."
},
{
"lang": "es",
"value": "n8n contiene una omisión de autenticación en el nodo Chat Trigger cuando se configura con n8n User Auth (una configuración no predeterminada). En las versiones afectadas - antes de la 1.123.22, la línea 2.0.0 a 2.9.2, y la 2.10.0 - la verificación de autenticación en el endpoint de webhook de Chat Trigger puede ser eludida, permitiendo el acceso sin credenciales válidas. Corregido en 1.123.22, 2.9.3, y 2.10.1."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "1.123.22",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.123.22",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "2.0.0",
"lessThan": "2.9.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.9.3",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "2.10.0",
"lessThan": "2.10.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.10.1",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-16T15:13:06.303735Z",
"id": "CVE-2026-56353",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.123.22",
"matchCriteriaId": "77E36F68-2FDD-4771-B2DD-3F0A168E92E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.9.3",
"matchCriteriaId": "CDB18D4D-1D4C-422A-BE3E-0FF8FC9DDD82"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.10.0:*:*:*:community:node.js:*:*",
"matchCriteriaId": "B665A0E7-0DC8-4B25-9D16-BA3B2CBFB12C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.10.0:*:*:*:enterprise:node.js:*:*",
"matchCriteriaId": "B30DD229-9AF2-4E3D-B1BC-C6014B510ADE"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/n8n-authentication-bypass-in-chat-trigger-node",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}