CVE-2026-65594

{
  "id": "CVE-2026-65594",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T12:18:19.527",
  "lastModified": "2026-10-29T20:17:32.553",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation."
    },
    {
      "lang": "es",
      "value": "n8n anterior a 2.29.8 y 2.30.x anterior a 2.30.1 (afectado desde 2.27.0, cuando se introdujo el flujo de consentimiento y emisión de tokens de OAuth 2.1) no verifica que el usuario autenticado tenga acceso al flujo de trabajo referenciado como recurso OAuth. En instancias con al menos un flujo de trabajo activo de MCP Server Trigger configurado con autenticación n8n OAuth2, un usuario de nivel de miembro puede registrar un cliente OAuth, autoaprobar el consentimiento para el flujo de trabajo de otro usuario y obtener un token válido. El flujo de trabajo se ejecuta entonces en el contexto del proyecto del propietario con las credenciales almacenadas del propietario, y el atacante puede establecer entradas de herramientas y leer salidas (potencialmente incluyendo datos de las integraciones conectadas del propietario), rompiendo el aislamiento de usuario y proyecto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "versions": [
            {
              "version": "2.30.0",
              "lessThan": "2.30.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.30.1",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.29.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.29.8",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T18:01:20.810448Z",
          "id": "CVE-2026-65594",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
              "versionStartIncluding": "2.27.0",
              "versionEndExcluding": "2.29.8",
              "matchCriteriaId": "CFB4F855-223D-48A3-B407-E8E70BB3CA19"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
              "versionStartIncluding": "2.27.0",
              "versionEndExcluding": "2.29.8",
              "matchCriteriaId": "B4805BAC-0769-4DE6-B3E0-E84CA029E03E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*",
              "matchCriteriaId": "E125F7EF-F72F-427F-82DE-D6A505B1DF8F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*",
              "matchCriteriaId": "3C2780A0-55EC-488D-9149-EE83BA246A38"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}