CVE-2026-65595 Details
Description
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.
A vulnerability in n8n versions prior to 2.30.1 and 2.29.8 allows low-privileged users to escalate privileges and execute code remotely. This issue arises because all Public API key scopes are assigned to JSON Web Tokens (JWTs) issued through the Token Exchange module, regardless of the user's role. On instances where Token Exchange and the Public API are enabled, a low-privileged user who obtains a valid external JWT from a trusted issuer can use it to access administrator-only Public API functions. These functions include role escalation, user creation, and user deletion. Additionally, if unverified Community Package installation is allowed, this vulnerability could lead to remote code execution.
Users should upgrade to n8n version 2.30.1 or 2.29.8. If an immediate upgrade is not possible, administrators can disable the Token Exchange feature, restrict Public API access to trusted clients, or disable unverified Community Package installation as temporary mitigations.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 2.29.8 2.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |