Executive brief
n8n is a workflow automation platform used to connect different software services. A security flaw allows a standard user to bypass authorization checks and execute automated workflows belonging to other users. This could allow an attacker to access sensitive data from connected third-party integrations or perform actions using another user's credentials, potentially leading to a significant breach of data privacy and project isolation.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in n8n's OAuth 2.1 consent and token-issuance flow. The application fails to verify if an authenticated user has the necessary permissions to access a workflow referenced as an OAuth resource. By registering an OAuth client and self-approving consent for a target workflow, a member-level user can obtain a valid token. This allows the attacker to trigger MCP Server workflows in the context of the owner's project, utilizing the owner's stored credentials to set tool inputs and read outputs. The vulnerability affects versions 2.27.0 through 2.29.7 and version 2.30.0. It is fixed in versions 2.29.8 and 2.30.1.
Affected products
- n8n-io n8n >= 2.27.0, < 2.29.8; 2.30.0
Timeline
- 2026-07-08: advisory: Original advisory GHSA-q5xf-xhwf-cwqf published
- 2026-07-22: disclosed: CVE-2026-65594 published
- 2026-07-22: other: Duplicate advisory GHSA-5vfw-jc4p-fj39 published and withdrawn