n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-65016
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- October 24, 2026
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into workflows. This flaw affects n8n versions before 1.123.64, 2.29.8 and 2.30.1, in the Enterprise single sign-on feature. It matters only if three things are true: single sign-on is set up, the option that lets your sign-in service set each user's role in n8n is turned on (it is off by default), and an attacker can control the role your sign-in service reports for them. That person could become the owner of your n8n setup, with full control over workflows, stored login credentials, users and settings. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization, or the IT provider who manages it, should act on this flaw.
- Update n8n to version
1.123.64,2.29.8or2.30.1, or a later release. These versions fix this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- This flaw can only be used when Enterprise single sign-on is set up and the option that lets your sign-in service set user roles is turned on. If you do not use these today, you should still update.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.