https://vulnerability.circl.lu/sightings/feed 2026-07-07T03:14:52.071212+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5585b011-3070-4c28-b60e-90acc7f8f42a/export 2026-07-07T03:14:52.087857+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5585b011-3070-4c28-b60e-90acc7f8f42a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vjf3-2gpj-233v", "type": "seen", "source": "https://gist.github.com/alon710/8dfa8b639d7c92db923d54e0e8243293", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:59:30.849074Z"} 2026-07-06T07:59:30.849074+00:00 https://vulnerability.circl.lu/sighting/8b7af7e7-b037-4862-a1f3-b8be02c4ab01/export 2026-07-07T03:14:52.089155+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8b7af7e7-b037-4862-a1f3-b8be02c4ab01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vjf3-2gpj-233v", "type": "seen", "source": "https://gist.github.com/alon710/d7446e83b138301fa78ba45ab4a16d68", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:58:49.338206Z"} 2026-07-06T07:58:49.338206+00:00 https://vulnerability.circl.lu/sighting/f05a46ac-e9f6-426f-adf2-d7b2f91b86ef/export 2026-07-07T03:14:52.089266+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f05a46ac-e9f6-426f-adf2-d7b2f91b86ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-VJF3-2GPJ-233V", "type": "seen", "source": "https://gist.github.com/alon710/ebc773370e1f1607b2bfdb1617822e65", "content": "", "creation_timestamp": "2026-02-27T02:10:20.000000Z"} 2026-02-27T02:10:20+00:00