n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-65595
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- October 24, 2026
Description
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.
Description quoted from the NVD record.
Who is affected
n8n is a platform for automating tasks across your apps and services. This flaw affects n8n versions before 2.30.1 and 2.29.8 when both the Token Exchange feature (sign-in using tokens from an outside login service) and the Public API (which lets other programs control n8n) are turned on. A low-privileged user holding a valid token from a trusted outside login service could perform administrator-only actions, such as creating or deleting users and raising user roles (raising roles requires an Advanced Permissions license). If installing unverified community add-ons is allowed, the attacker could run their own code on the server. This flaw is rated High.
What to do
- Find out who installed or runs n8n for your organization, whether that is someone on your staff or an outside IT provider. That person or provider should act on this flaw.
- If your organization runs n8n itself, have that person update n8n to version
2.30.1or2.29.8, the fixed versions named for this flaw. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- For details on the fixed releases, read the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.