CVE-2026-56350

Katalog CVE

CVSS 7.7 · High EPSS 0,38%

Kerentanan Improper Authorization pada n8n. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api advisory pihak ketiga