https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 06 Jul 2026 18:06:18 +0000 https://vulnerability.circl.lu/sighting/c1a5adc2-3600-446b-918b-e4d8c7ac245c/export {"uuid": "c1a5adc2-3600-446b-918b-e4d8c7ac245c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56350", "type": "seen", "source": "https://gist.github.com/alon710/8dfa8b639d7c92db923d54e0e8243293", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:59:30.801200Z"} {"uuid": "c1a5adc2-3600-446b-918b-e4d8c7ac245c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56350", "type": "seen", "source": "https://gist.github.com/alon710/8dfa8b639d7c92db923d54e0e8243293", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:59:30.801200Z"} https://vulnerability.circl.lu/sighting/c1a5adc2-3600-446b-918b-e4d8c7ac245c/export Mon, 06 Jul 2026 07:59:30 +0000 https://vulnerability.circl.lu/sighting/6fc2e076-ac26-452b-aef6-784cda3bdf42/export {"uuid": "6fc2e076-ac26-452b-aef6-784cda3bdf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56350", "type": "seen", "source": "https://gist.github.com/alon710/d7446e83b138301fa78ba45ab4a16d68", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:58:49.287970Z"} {"uuid": "6fc2e076-ac26-452b-aef6-784cda3bdf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56350", "type": "seen", "source": "https://gist.github.com/alon710/d7446e83b138301fa78ba45ab4a16d68", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:58:49.287970Z"} https://vulnerability.circl.lu/sighting/6fc2e076-ac26-452b-aef6-784cda3bdf42/export Mon, 06 Jul 2026 07:58:49 +0000 https://vulnerability.circl.lu/sighting/9e255e7b-610f-4cef-8f6b-487a9d794cde/export {"uuid": "9e255e7b-610f-4cef-8f6b-487a9d794cde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56356", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmj3rbyxs2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56356 \u0432 n8n: \u0443\u0433\u0440\u043e\u0437\u0430 XSS \u0432 Chat Trigger \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0D520B3E-468D-404C-8C27-FB6196238EC0", "creation_timestamp": "2026-07-01T21:56:28.730853Z"} {"uuid": "9e255e7b-610f-4cef-8f6b-487a9d794cde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56356", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmj3rbyxs2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56356 \u0432 n8n: \u0443\u0433\u0440\u043e\u0437\u0430 XSS \u0432 Chat Trigger \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0D520B3E-468D-404C-8C27-FB6196238EC0", "creation_timestamp": "2026-07-01T21:56:28.730853Z"} https://vulnerability.circl.lu/sighting/9e255e7b-610f-4cef-8f6b-487a9d794cde/export Wed, 01 Jul 2026 21:56:28 +0000 https://vulnerability.circl.lu/sighting/8f76e2f7-f874-4634-8ce2-7c8a01bb1fe9/export {"uuid": "8f76e2f7-f874-4634-8ce2-7c8a01bb1fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56358", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp24yidzsx2r", "content": "CVE-2026-56358 - n8n - Stored Cross-Site Scripting in Form Trigger Node\nCVE ID : CVE-2026-56358\n \n Published : June 24, 2026, 11:53 a.m. | 1\u00a0hour, 51\u00a0minutes ago\n \n Description : n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains ...", "creation_timestamp": "2026-06-24T14:31:58.674156Z"} {"uuid": "8f76e2f7-f874-4634-8ce2-7c8a01bb1fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56358", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp24yidzsx2r", "content": "CVE-2026-56358 - n8n - Stored Cross-Site Scripting in Form Trigger Node\nCVE ID : CVE-2026-56358\n \n Published : June 24, 2026, 11:53 a.m. | 1\u00a0hour, 51\u00a0minutes ago\n \n Description : n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains ...", "creation_timestamp": "2026-06-24T14:31:58.674156Z"} https://vulnerability.circl.lu/sighting/8f76e2f7-f874-4634-8ce2-7c8a01bb1fe9/export Wed, 24 Jun 2026 14:31:58 +0000 https://vulnerability.circl.lu/sighting/74f6612a-a62e-4814-a648-ab0cdeedafb2/export {"uuid": "74f6612a-a62e-4814-a648-ab0cdeedafb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56351", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp23dz6gn32s", "content": "CVE-2026-56351 - n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes\nCVE ID : CVE-2026-56351\n \n Published : June 24, 2026, 11:53 a.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, a...", "creation_timestamp": "2026-06-24T14:02:37.882644Z"} {"uuid": "74f6612a-a62e-4814-a648-ab0cdeedafb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56351", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp23dz6gn32s", "content": "CVE-2026-56351 - n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes\nCVE ID : CVE-2026-56351\n \n Published : June 24, 2026, 11:53 a.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, a...", "creation_timestamp": "2026-06-24T14:02:37.882644Z"} https://vulnerability.circl.lu/sighting/74f6612a-a62e-4814-a648-ab0cdeedafb2/export Wed, 24 Jun 2026 14:02:37 +0000 https://vulnerability.circl.lu/sighting/a6d86cb0-de37-48f3-be9a-90a9b3314f25/export {"uuid": "a6d86cb0-de37-48f3-be9a-90a9b3314f25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56355", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mor2koncd62v", "content": "CVE-2026-56355 - GNU Savannah Savane Authorization Bypass\nCVE ID : CVE-2026-56355\n \n Published : June 20, 2026, 8:08 p.m. | 3\u00a0hours, 35\u00a0minutes ago\n \n Description : GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.\n \n Severity: 3.7 |...", "creation_timestamp": "2026-06-20T23:54:30.369417Z"} {"uuid": "a6d86cb0-de37-48f3-be9a-90a9b3314f25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56355", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mor2koncd62v", "content": "CVE-2026-56355 - GNU Savannah Savane Authorization Bypass\nCVE ID : CVE-2026-56355\n \n Published : June 20, 2026, 8:08 p.m. | 3\u00a0hours, 35\u00a0minutes ago\n \n Description : GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.\n \n Severity: 3.7 |...", "creation_timestamp": "2026-06-20T23:54:30.369417Z"} https://vulnerability.circl.lu/sighting/a6d86cb0-de37-48f3-be9a-90a9b3314f25/export Sat, 20 Jun 2026 23:54:30 +0000 https://vulnerability.circl.lu/sighting/c81e1565-f8a7-4463-80b1-17548756a439/export {"uuid": "c81e1565-f8a7-4463-80b1-17548756a439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5635", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mit3npwoam2n", "content": "", "creation_timestamp": "2026-04-06T10:48:15.852402Z"} {"uuid": "c81e1565-f8a7-4463-80b1-17548756a439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5635", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mit3npwoam2n", "content": "", "creation_timestamp": "2026-04-06T10:48:15.852402Z"} https://vulnerability.circl.lu/sighting/c81e1565-f8a7-4463-80b1-17548756a439/export Mon, 06 Apr 2026 10:48:15 +0000