CVE-2026-65595: n8n privilege escalation in Token Exchange module

Executive brief

n8n is a workflow automation tool used to connect various business applications. A vulnerability in its token exchange system allows low-privileged users to gain full administrative control over the platform. An attacker could use this access to create or delete users, escalate their own permissions, and potentially execute unauthorized code, leading to a complete compromise of the automation environment and its connected data.

Technical details

A privilege management vulnerability (CWE-269) exists in n8n's Token Exchange module where JWTs are incorrectly assigned all Public API key scopes regardless of the user's actual role. An attacker with low-privileged access who can obtain a valid external JWT trusted by a configured issuer can exchange it for an access token with full administrative rights. This allows for unauthorized operations such as role escalation, user management, and, if community packages are enabled, remote code execution. The vulnerability requires N8N_TOKEN_EXCHANGE_ENABLED and the Public API to be active. It is patched in versions 2.30.1 and 2.29.8.

Affected products

• n8n-io n8n >= 2.30.0, < 2.30.1; < 2.29.8

Timeline

• 2026-07-08: disclosed: Initial disclosure by reporter
• 2026-07-22: advisory: GitHub Advisory published

References

• https://api.github.com/users/odgrso
• https://github.com/odgrso
• https://api.github.com/users/odgrso/gists%7B/gist_id%7D
• https://api.github.com/users/odgrso/repos
• https://avatars.githubusercontent.com/u/92903761?v=4
• https://api.github.com/users/odgrso/events%7B/privacy%7D