Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD8.9 High

CVE-2026-65595

n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 2.30.0 to < 2.30.1affected
  • 2.30.1unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 0 to < 2.29.8affected
  • 2.29.8unaffected
pkg:npm/n8n

References