n8n Privilege Escalation Vulnerability (CVE-2026-65016) — High Severity

Overview

A significant security flaw has been discovered in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-65016, allows an attacker to escalate their privileges to gain full administrative control over an n8n instance. This occurs specifically when Enterprise Single Sign-On (SSO) is enabled and improperly configured, allowing an attacker to manipulate their assigned role within the system.

CVE Details

• Product: n8n
• Published Date: July 22, 2026
• Severity: High
• Status: Analyzed

Affected Products

This privilege escalation vulnerability impacts several versions of n8n, specifically:

• n8n versions prior to 1.123.64
• n8n versions prior to 2.29.8
• n8n versions prior to 2.30.1

Both community and enterprise editions of n8n running on Node.js are affected if they fall within these version ranges.

Current Status

The vulnerability is currently "Analyzed", meaning it has been investigated, and information regarding its nature, impact, and potential solutions has been made available.

Severity Level

Rated as "High" severity with a CVSS score of 8.8, this vulnerability poses a serious risk. A high severity rating indicates that exploiting this flaw could lead to significant unauthorized access and control. In this case, an attacker could become an "instance owner," gaining complete administrative power over all workflows, user accounts, credentials, and the overall configuration of the affected n8n platform. This could result in severe data breaches, system manipulation, and widespread disruption if exploited.

Possible Solutions

The n8n team has released updates to address this vulnerability. Users are strongly advised to upgrade their n8n instances to one of the following patched versions or later:

• n8n version 1.123.64
• n8n version 2.29.8
• n8n version 2.30.1

If immediate upgrading is not feasible, the following temporary workarounds can help mitigate the risk, though they do not fully eliminate it:

1. Disable instance-role provisioning: Ensure the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE flag is unset or explicitly set to false. This feature is disabled by default, so verify its status if you are using Enterprise SSO.
2. Audit IdP claim mappings: Review your Identity Provider (IdP) configurations to confirm that no user-controlled attributes can influence the instance-role claim value. This prevents attackers from asserting a global:owner role.
3. Restrict SSO access: Limit Enterprise SSO access to only fully trusted users.

These workarounds should be considered short-term measures. A full upgrade to a patched version is the recommended and most effective solution.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf
• https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role