CVE-2026-65016
Full vulnerability record from the local CVENow database.
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.
Severity
HIGH
CVSS score
7.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-22 12:18:18.733000
Last modified
2026-10-29 19:17:25.800000
View original CVE JSON
{
"id": "CVE-2026-65016",
"sourceIdentifier": "[email protected]",
"published": "2026-07-22T12:18:18.733",
"lastModified": "2026-10-29T19:17:25.800",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP."
},
{
"lang": "es",
"value": "Las versiones de n8n anteriores a la 1.123.64, 2.29.8 y 2.30.1 contienen una vulnerabilidad de escalada de privilegios en el aprovisionamiento de roles de instancia de SSO Empresarial. La ruta de aprovisionamiento mapea una declaración de rol afirmada por el IdP a un rol global de n8n, pero no impide la asignación del rol global:owner (a diferencia de la ruta de identidad de intercambio de tokens, que lo rechaza). Un usuario autenticado por SSO cuya declaración de rol de instancia se resuelve como global:owner es aprovisionado como propietario de la instancia, obteniendo control administrativo total sobre flujos de trabajo, credenciales, usuarios y configuración de la instancia. La explotación requiere que el SSO Empresarial esté configurado, que el aprovisionamiento de roles de instancia esté habilitado a través de N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (deshabilitado por defecto), y que el atacante controle el valor de la declaración de rol de instancia emitido por el IdP."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "1.123.64",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.123.64",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.30.0",
"lessThan": "2.30.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.30.1",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.0.0-rc.0",
"lessThan": "2.29.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.8",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-23T18:16:35.338246Z",
"id": "CVE-2026-65016",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionEndExcluding": "1.123.64",
"matchCriteriaId": "843094AD-81C8-4961-A8A1-037468DEACA7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionEndExcluding": "1.123.64",
"matchCriteriaId": "E1626500-EC42-4BF5-8ECE-6E5E249D37F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.29.8",
"matchCriteriaId": "3281592C-CB07-412C-9770-3521447ADEC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.29.8",
"matchCriteriaId": "E4A0C557-F57B-4931-A857-ACC4639C030D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*",
"matchCriteriaId": "E125F7EF-F72F-427F-82DE-D6A505B1DF8F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*",
"matchCriteriaId": "3C2780A0-55EC-488D-9149-EE83BA246A38"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}