PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56354 n8n CVE debrief

CVE-2026-56354 is a medium-severity vulnerability in n8n, a workflow automation tool. The vulnerability exists in the Form Node and is caused by unsanitized HTML description fields and overly permissive iframe sandbox policies. This allows authenticated users with workflow creation permissions to inject malicious scripts or redirect parameters, potentially leading to stored XSS attacks or phishing redirects against end users.

Vendor
n8n
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-10
Original CVE updated
2026-07-13
Advisory published
2026-07-10
Advisory updated
2026-07-13

Who should care

Users of n8n, particularly those with workflow creation permissions, should be aware of this vulnerability. Administrators and security teams responsible for n8n instances should prioritize patching to prevent potential attacks.

Technical summary

The vulnerability in n8n's Form Node allows for cross-site scripting (XSS) and open redirect attacks. The issue arises from unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can exploit this vulnerability to inject malicious scripts or redirect parameters. This could lead to stored XSS attacks or phishing redirects against end users. The CVSS score for this vulnerability is 5.1, indicating a medium severity level.

Defensive priority

Patching affected n8n instances should be prioritized due to the potential for authenticated users to exploit this vulnerability for malicious purposes.

Recommended defensive actions

  • Apply patches or updates to n8n versions 1.123.24, 2.10.4, or 2.12.0, or later
  • Restrict workflow creation permissions to trusted users
  • Monitor n8n instances for suspicious activity
  • Implement additional security measures such as input validation and output encoding
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-10T15:16:43.030Z and was last modified on 2026-07-10T17:49:57.737Z. The NVD entry is currently Undergoing Analysis. References include GitHub security advisories and Vulncheck advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56354 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56354

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56354 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56354

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.