CVE-2026-65594 Details
Description
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation.
A vulnerability exists in n8n versions prior to 2.30.1 and 2.29.8, specifically affecting versions 2.27.0 and later, where the OAuth 2.1 consent and token-issuance flow lacks proper authorization checks. This flaw allows member-level users to access workflows of other users by self-approving consent for workflows protected by 'n8n OAuth2' authentication, particularly those using an MCP Server Trigger. Once access is granted, the attacker can execute the workflow using the owner's credentials, manipulate inputs, and access outputs, potentially compromising data from the owner's integrated applications and violating user and project confidentiality.
Users should upgrade to n8n version 2.30.1 or 2.29.8. If an immediate upgrade is not possible, restrict access to the n8n instance to trusted users only and audit active workflows using the MCP Server Trigger with 'n8n OAuth2' authentication, considering deactivating them until the patch is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | >= 2.27.0, < 2.29.8 2.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |