Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security flaw in its token exchange system allows low-privileged users to gain full administrative control over the platform. This could lead to unauthorized data access, the creation or deletion of user accounts, and in some configurations, the ability for an attacker to run malicious code on the server.
Technical details
n8n suffers from improper privilege management (CWE-269) in its Token Exchange module. The application assigns all Public API key scopes to JWTs issued through this module regardless of the user's actual role. An attacker with low-privileged access who can provide a valid external JWT from a trusted issuer can obtain an access token with administrative rights. This allows for role escalation, user management, and, if unverified Community Packages are enabled, remote code execution (RCE). The vulnerability is present when both the Token Exchange and Public API features are enabled. It has been patched in versions 2.29.8 and 2.30.1.
Affected products
- n8n-io n8n < 2.29.8, < 2.30.1
Timeline
- 2026-07-08: advisory: Original advisory GHSA-777w-rpr6-c52h published
- 2026-07-22: disclosed: CVE-2026-65595 published and duplicate advisory GHSA-wq64-hcrf-8m56 released
- 2026-07-22: patched: Fixes confirmed in versions 2.29.8 and 2.30.1