CVE-2026-59208 Details
Description
n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.
A vulnerability exists in n8n workflow automation platform versions prior to 2.27.4 and from 2.28.0 prior to 2.28.1. In instances configured with multiple trusted token-exchange issuers, external identities are mapped to local accounts using only the JWT 'sub' claim, disregarding the 'iss' claim. This flaw allows an attacker with a valid token from one issuer, whose 'sub' matches that of a victim under a different issuer, to authenticate as that victim. The issue arises when the token exchange feature is enabled and more than one trusted issuer is active.
Users should upgrade to n8n version 2.28.1 or later. If an immediate upgrade is not possible, consider reducing the token exchange configuration to a single trusted issuer or disabling the token exchange feature entirely if it is not in active use.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4 | [email protected] | Release Notes |
| https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1 | [email protected] | Release Notes |
| https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 2.27.4 2.28.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | New CVE Received | [email protected] |