Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.9, published 22 July 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-07-22: Fixes confirmed in versions 2.29.8 and 2.30.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

n8n privilege escalation and code execution in Token Exchange module

Severity: high · CVSS 8.9 · Published 2026-07-22

n8n is a popular workflow automation tool used to connect different software services. A security flaw in its token exchange system allows low-privileged users to gain full administrative control over the platform. This could lead to unauthorized data access, the creation or deletion of user accounts, and in some configurations, the ability for an attacker to run malicious code on the server.

Technologies: N8n. Vendors: N8n.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.9, published 22 July 2026.
Which products and versions are affected?: N8n < 2.29.8, < 2.30.1.
Is there a fix for This vulnerability?: A patch was published on 2026-07-22: Fixes confirmed in versions 2.29.8 and 2.30.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

n8n suffers from improper privilege management (CWE-269) in its Token Exchange module. The application assigns all Public API key scopes to JWTs issued through this module regardless of the user's actual role. An attacker with low-privileged access who can provide a valid external JWT from a trusted issuer can obtain an access token with administrative rights. This allows for role escalation, user management, and, if unverified Community Packages are enabled, remote code execution (RCE). The vulnerability is present when both the Token Exchange and Public API features are enabled. It has been patched in versions 2.29.8 and 2.30.1.

Affected products

n8n-io n8n < 2.29.8, < 2.30.1

Timeline

2026-07-08: advisory: Original advisory GHSA-777w-rpr6-c52h published
2026-07-22: disclosed: CVE-2026-65595 published and duplicate advisory GHSA-wq64-hcrf-8m56 released
2026-07-22: patched: Fixes confirmed in versions 2.29.8 and 2.30.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.