Understanding the n8n Account Takeover Vulnerability
A serious security flaw has been discovered in n8n, an open-source workflow automation platform, that could allow unauthorized individuals to take over user accounts. This vulnerability, identified as CVE-2026-72772, is rated with High severity and specifically impacts instances where the “Token Exchange Embed Login” feature is active and configured with trusted keys.
The core issue lies in how n8n handled incoming tokens. When a token was used to match a local account based on its email address, the system failed to properly verify if that email address itself was legitimate or if the trusted key used for the token had the necessary permissions for that specific account. This oversight meant that if an attacker could get hold of a token from a trusted source (even one that issues unverified email addresses), they could then log in as any existing user on the n8n instance and gain full control over their account.
CVE Details
- Product: n8n
- Published: August 11, 2026
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability affects specific versions of the n8n platform. Users running versions older than 2.32.1 or prior to 2.31.5 are at risk. It’s important to note that this issue only arises if your n8n instance has the embed login feature enabled and at least one trusted key configured for token exchange.
Current Status
The vulnerability has been thoroughly analyzed, and the necessary information has been made public to alert users. It is crucial for administrators and developers to address this issue promptly to protect their n8n installations.
Severity Level
Rated as High severity, this account takeover vulnerability poses a significant risk. A successful exploitation could lead to complete compromise of user accounts, potentially exposing sensitive data, disrupting automated workflows, or allowing attackers to perform malicious actions within the n8n environment. The ability to gain full account control highlights the critical nature of this flaw.
Possible Solutions
The n8n team has released patches to address this vulnerability. Users are strongly advised to upgrade their n8n instances to the following versions or newer:
- n8n version 2.32.1 or later
- n8n version 2.31.5 or later
If an immediate upgrade isn’t feasible, temporary mitigation steps can be taken, though they do not fully eliminate the risk:
- Disable Embed Login: Set the environment variable
N8N_TOKEN_EXCHANGE_ENABLEDtofalse. - Restrict Network Access: If embed login must remain enabled, limit network access to your n8n instance to only fully trusted parties.
- Audit Trusted Keys: Carefully review all configured trusted keys and their associated
allowedRolesassignments. - Check Auth Records: Look for any unusual
token-exchangeentries linked to high-privilege accounts within yourauth_identityrecords.
These workarounds are temporary and should be replaced with a full upgrade as soon as possible.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr
https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-token-exchange
