Answer in brief
CVE-2026-56778 records a Medium severity (CVSS 6.4) vulnerability in n8n - Authorization Bypass in Public API Execution Retry Endpoint. The current sources do not mark it as known exploited. The current feed maps n8n/n8n (generic), n8n/n8n (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n8n/n8n (generic), n8n/n8n (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n8n/n8ngeneric | >=0 <2.26.2 | 2.26.2 |
| n8n/n8ngeneric | >=0 <2.25.7 | 2.25.7 |
Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-56778 records a Medium severity (CVSS 6.4) vulnerability in n8n - Authorization Bypass in Public API Execution Retry Endpoint. The current sources do not mark it as known exploited. The current feed maps n8n/n8n (generic), n8n/n8n (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n8n/n8n (generic), n8n/n8n (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n8n/n8ngeneric | >=0 <2.26.2 | 2.26.2 |
| n8n/n8ngeneric | >=0 <2.25.7 | 2.25.7 |
Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.
Quoted source text, attributed separately from HOL analysis.