CVE-2026-56349: n8n - Guardrail Node Bypass via Crafted Input

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-25
Weakness: CWE-20

Description

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

Affected products

n8n-io n8n: before 2.10.0 — fixed in 2.10.0

How to fix

Upgrade to a fixed version: n8n-io n8n 2.10.0. Check the vendor advisory for mitigations.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w
https://www.vulncheck.com/advisories/n8n-guardrail-node-bypass-via-crafted-input

Get alerted when CVE-2026-56349 or the next vulnerability affects your stack