Executive brief
n8n is a workflow automation platform. A vulnerability in its Token Exchange feature allows low-privileged users with access to external JWTs to obtain API tokens with full administrator permissions, enabling account creation, user deletion, role escalation, and potentially remote code execution through unverified package installation. This affects organizations using n8n's Token Exchange and Public API features together.
Technical details
The vulnerability exists in n8n's Token Exchange module, which incorrectly assigns all Public API key scopes to JWTs issued via token exchange, regardless of the requesting user's actual role. The root cause is improper authorization validation during JWT issuance. An attacker with low privileges who can obtain a valid external JWT trusted by a configured issuer can exchange it for an API token with full administrator scope. This enables invocation of sensitive admin-only APIs including role escalation (requires Advanced Permissions license), user creation/deletion, and potentially remote code execution if unverified Community Package installation is enabled. The vulnerability requires both Token Exchange and Public API features to be enabled (N8N_TOKEN_EXCHANGE_ENABLED=true, N8N_ENV_FEAT_TOKEN_EXCHANGE=true). Patches are available in versions 2.30.1 and 2.29.8.
Affected products
- n8n n8n < 2.29.8, < 2.30.1
Timeline
- 2026-07-08: disclosed
- 2026-07-22: advisory
- 2026-07-08: patched: Patched in versions 2.30.1 and 2.29.8