CVE-2026-56778: n8n — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-56778

CVSS 6.4 · Medium EPSS 0,30%

Kerentanan Incorrect Authorization pada n8n. Skor CVSS 3.1 6.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

Rincian

Terbit di NVD: 8 Juli 2026
Terakhir diubah: 8 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 6.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
n8n	n8n	Semua versi sebelum 2.25.7
n8n	n8n	Versi 2.26.0 hingga sebelum 2.26.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685 mitigasi · advisory vendor
https://www.vulncheck.com/advisories/n8n-authorization-bypass-in-public-api-execution-retry-endpoint advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.