Cross-Site Scripting in n8n Workflow Automation Platform

Executive Summary

CVE-2026-56359 is a cross-site scripting (XSS) vulnerability found in n8n versions before 2.8.0 and 2.6.4. It occurs in the credential management flow, specifically in the OAuth2 credential Authorization URL field. Authenticated users with permission to create credentials can inject malicious JavaScript URLs into this field.

Attackers exploit this by crafting malicious credentials and tricking victims into clicking the OAuth authorization button. When the victim interacts with this button, the injected script executes in their browser session with their privileges, potentially allowing arbitrary script execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary script execution in the victim's browser session with their privileges. This means an attacker could perform actions on behalf of the victim, potentially accessing sensitive information or manipulating the victim's session.

However, exploitation requires the attacker to be an authenticated user with permission to create and share credentials, and the victim must interact by clicking the OAuth authorization button. The impact on confidentiality and integrity is considered low, and the overall severity is rated as moderate with a CVSS score of 4.8.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious JavaScript injection into the OAuth2 credential Authorization URL field by authenticated users. Detection involves identifying suspicious or unexpected JavaScript URLs in OAuth2 credential Authorization URL fields within the n8n application before version 2.8.0.

Since the vulnerability is related to credential management within the n8n application, detection commands would focus on inspecting stored OAuth2 credentials for suspicious Authorization URL values.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade n8n to version 2.8.0 or later (or 2.6.4 or later if applicable), where the vulnerability has been patched.

As a temporary mitigation before upgrading, restrict credential creation and sharing permissions to trusted users only.

Additionally, limit access to the n8n instance to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to inject malicious JavaScript into OAuth2 credential Authorization URL fields, which can lead to execution of arbitrary scripts in victims' browser sessions with their privileges.

This type of cross-site scripting (XSS) vulnerability could potentially impact compliance with standards like GDPR and HIPAA by exposing user sessions to unauthorized script execution, which may lead to unauthorized access or disclosure of sensitive information.

However, the vulnerability requires user interaction and authenticated access with permission to create and share credentials, which somewhat limits the risk.

To maintain compliance, affected users should apply the available patches and implement recommended mitigations such as restricting credential creation and sharing permissions to trusted users and limiting access to the n8n instance.

Useful 0 Not Useful 0