CVE-2026-65016 Details

A privilege escalation vulnerability has been identified in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. This vulnerability exists in the Enterprise Single Sign-On (SSO) instance-role provisioning, where an IdP-asserted role claim is mapped to an n8n global role. The issue arises because the provisioning path does not block the assignment of the global:owner role, unlike the token-exchange identity path, which explicitly rejects it. Consequently, an SSO-authenticated user whose instance-role claim is linked to global:owner is granted instance owner status, allowing full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires Enterprise SSO to be configured, instance-role provisioning to be enabled via the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE flag (which is off by default), and the attacker to control the instance-role claim value issued by the Identity Provider (IdP).

Users can upgrade to n8n versions 1.123.64, 2.30.1, or 2.29.8 to address this vulnerability. If an immediate upgrade is not possible, administrators can temporarily disable instance-role provisioning, audit IdP claim mappings to prevent user-controlled attributes from influencing the instance-role claim, and restrict SSO access to trusted users only.