CVE-2026-56776: 
NixOS 취약성 분석 및 완화

CVE-2026-56776 is an authorization bypass vulnerability in n8n, the open-source workflow automation platform, affecting the POST /workflows/{workflowId}/test-runs/new endpoint. The endpoint incorrectly authorizes access using the workflow:read scope instead of the required workflow:execute scope, allowing authenticated users with read-only permissions to trigger real workflow execution. Affected versions include n8n before 1.123.55, before 2.25.7, and before 2.26.2 (for the 2.26.x branch). It was published on July 8, 2026, with a CVSS v3.1 score of 7.4 (High) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) — the POST /workflows/{workflowId}/test-runs/new endpoint performs an authorization check but validates against the workflow:read OAuth scope rather than the correct workflow:execute scope (GitHub Advisory). An attacker exploits this by sending a POST request to the test-runs endpoint while authenticated with only read-only credentials, causing the internal workflow runner to execute the workflow as if fully authorized. The precondition for exploitation requires: (1) an authenticated account with workflow:read access, (2) the Evaluations feature to be enabled, and (3) an RBAC configuration where workflow:read is granted without workflow:execute (Github Advisory). No public proof-of-concept code has been identified at this time.

Successful exploitation allows a read-only user to trigger full workflow execution, resulting in unintended outbound API calls, data mutations, or other side effects in downstream systems connected to the workflow (GitHub Advisory). The scope of impact extends beyond the n8n instance itself to any third-party services, databases, or APIs integrated into the affected workflows, creating risks of unauthorized data modification and unintended business process execution. Confidentiality, integrity, and availability of both the vulnerable system and subsequent connected systems are assessed as low-impact individually, but the chained effect across integrated downstream systems can be significant in production environments with sensitive workflows.

1. Reconnaissance: Identify an n8n instance running a vulnerable version (before 1.123.55, 2.25.7, or 2.26.2) with the Evaluations feature enabled and RBAC project roles configured.
2. Obtain read-only credentials: Acquire or use an existing authenticated account that has been granted workflow:read access (but not workflow:execute) on a target workflow — for example, a project member with a viewer role.
3. Identify target workflow ID: Use the n8n API or UI (accessible with read permissions) to enumerate available workflows and obtain the workflowId of a workflow with sensitive integrations or side effects.
4. Send malicious POST request: Issue a POST /workflows/{workflowId}/test-runs/new HTTP request using the read-only account's authentication token. The endpoint will incorrectly accept the workflow:read scope and authorize the request.
5. Trigger workflow execution: The internal workflow runner executes the workflow in full, causing any configured actions — such as outbound API calls, database writes, or messaging — to fire against connected downstream systems (GitHub Advisory).

• Network: Unexpected outbound API calls or webhook triggers originating from the n8n server that correlate with workflow execution but were not initiated by authorized users or scheduled triggers.
• Logs: n8n application logs showing POST /workflows/{workflowId}/test-runs/new requests from accounts with read-only RBAC roles; workflow execution records attributed to users who should not have execute permissions.
• Application: Workflow execution history entries (visible in the n8n UI under Executions) showing test-run executions triggered by users with viewer/read-only project roles, especially outside normal business hours or in high frequency.

Users should upgrade n8n to version 1.123.55, 2.25.7, or 2.26.2 (or later), which fix the incorrect scope check on the test-runs endpoint (GitHub Advisory). If immediate upgrade is not possible, administrators should restrict workflow access to fully trusted users only and audit RBAC project role assignments to ensure workflow:read is not granted to users who should not be permitted to execute workflows. These workarounds do not fully remediate the risk and should be treated as short-term measures only.

The vulnerability was reported by researcher '34selen' and published by n8n maintainer 'Jubke' via GitHub Security Advisories on June 10, 2026, with the CVE assigned on July 8, 2026 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time.