CVE-2026-65595 in n8n
Summary
by MITRE • 07/22/2026
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical authorization flaw in n8n versions prior to 2.30.1 and 2.29.8 that fundamentally undermines the application's security model through improper scope assignment in the Token Exchange module. The issue stems from the system's failure to properly validate and restrict API key scopes based on the acting user's privileges when issuing JSON Web Tokens through the Public API functionality. When both the Token Exchange feature and Public API are enabled, this flaw creates a path for privilege escalation that bypasses normal access controls.
The technical implementation flaw occurs within the JWT issuance process where the system indiscriminately assigns all available Public API key scopes to tokens regardless of the requesting user's actual authorization level or role permissions. This creates a scenario where any low-privileged user who can obtain a valid external JWT from a trusted issuer can leverage this access token to perform operations that should be restricted to administrator-level accounts. The vulnerability specifically affects operations including but not limited to role escalation, user creation, and user deletion functions that are typically protected by strict access controls.
The operational impact of this vulnerability extends far beyond simple privilege escalation, particularly when combined with other system configurations. When unverified Community Package installation is enabled, the threat landscape becomes significantly more dangerous as attackers can potentially achieve remote code execution through malicious package installations. This represents a severe compromise of the application's integrity and confidentiality, as unauthorized users can not only modify user accounts and permissions but also potentially gain complete control over the system infrastructure.
This vulnerability maps directly to CWE-284 (Improper Access Control) and CWE-798 (Use of Hard-coded Credentials) while also aligning with ATT&CK techniques such as T1078 (Valid Accounts) and T1566 (Phishing). The attack vector demonstrates how improper scope assignment in token-based authentication systems can create persistent backdoors for unauthorized access. Organizations using n8n with Token Exchange functionality enabled should immediately implement mitigations including disabling unused features, implementing proper role-based access controls, and ensuring that all external JWT issuers are properly validated and restricted.
The recommended remediation strategy involves updating to n8n versions 2.30.1 or 2.29.8 where the scope assignment has been corrected to properly validate user roles before assigning API key permissions. Additionally, system administrators should disable the Token Exchange feature when not required, implement proper JWT issuer validation procedures, and ensure that all external identity providers are properly configured with appropriate access restrictions. Organizations should also conduct thorough security audits of their token-based authentication systems to identify similar scope assignment issues that may exist in other components of their infrastructure.