CVE-2026-56353: n8n

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.

Affected products

• n8n n8n: before 1.123.22 (fixed in 1.123.22); from 2.0.0, before 2.9.3 (fixed in 2.9.3); version 2.10.0 only

Published 2026-07-15. Last modified 2026-07-16.