n8n has XSS in its Credential Management Flow
Medium5.4CVE-2026-56359 · Published Mar 27, 2026 · updated Jul 9, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 2.7.0, < 2.8.0 | 2.8.0 |
| < 2.6.4 | 2.6.4 |
Details and references
## Impact An authenticated user with permission to create and share credentials could craft a malicious OAuth2 credential containing a JavaScript URL in the Authorization URL field. If a victim opened the credential and interacted with the OAuth authorization button, the injected script would execute in their browser session. ## Patches The issue has been fixed in n8n versions 2.8.0 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit credential creation and sharing permissions to fully trusted users only. - Restrict access to the n8n instance to trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2026-56359
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 26 | n8n Vulnerable to LDAP Filter Injection in LDAP Node CVE-2026-33751Medium4.8fixed in 1.123.27, 2.13.3, 2.14.1 | Medium4.8 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 26 | n8n Vulnerable to XSS via Binary Data Inline HTML Rendering CVE-2026-33749Medium8.9fixed in 1.123.27, 2.13.3, 2.14.1 | Medium8.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 26 | n8n has SQL Injection in Data Table Node via orderByColumn Expression CVE-2026-33713High9.9fixed in 1.123.26, 2.13.3, 2.14.1 | High9.9 | 1.123.26, 2.13.3, 2.14.1 |
| Mar 26 | n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE CVE-2026-33696Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 27 | n8n has a Stored XSS Vulnerability in its Form Trigger CVE-2026-56358Medium5.4fixed in 1.123.25, 2.11.2 | Medium5.4 | 1.123.25, 2.11.2 |
| Mar 27 | n8n: Authenticated XSS and Open Redirect via Form Node CVE-2026-56354Medium4.1fixed in 1.123.24, 2.10.4, 2.12.0 | Medium4.1 | 1.123.24, 2.10.4, 2.12.0 |