Executive brief
n8n is a workflow automation platform that allows users to connect and automate tasks across applications. A flaw in its OAuth 2.1 authentication flow for MCP Server Trigger workflows allows member-level users to bypass authorization checks and execute workflows owned by other users. An attacker with member access can register an OAuth client, approve consent for another user's workflow, and obtain a valid token, then execute the workflow with the owner's credentials and access sensitive data from connected integrations, breaking isolation between users and projects.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0. The vulnerable component fails to verify that an authenticated user has access to the workflow being referenced as an OAuth resource. An authenticated member-level user can register an OAuth client, self-approve consent for another user's n8n OAuth2-protected MCP Server Trigger workflow, and obtain a valid access token. Upon successful token issuance, the attacker can invoke the workflow, which executes in the owner's project context using the owner's stored credentials. The attacker can manipulate tool inputs and read workflow outputs, potentially accessing sensitive data from the owner's connected integrations. The attack requires: (1) member-level authentication to the n8n instance, (2) at least one active MCP Server Trigger workflow configured with OAuth2 authentication, and (3) no user interaction from the victim. Patches are available in n8n versions 2.29.8 and 2.30.1 and later.
Affected products
- n8n n8n 2.27.0 to 2.29.7, 2.30.0
Timeline
- 2026-07-22: disclosed
- 2026-07-08: patched: Patches released in versions 2.29.8 and 2.30.1