CVE-2026-65595: CVE-2026-65595: Privilege Escalation and Remote Code Execution in n8n Token Exchange Module

#security #cve #cybersecurity

CVE-2026-65595: Privilege Escalation and Remote Code Execution in n8n Token Exchange Module

Vulnerability ID: CVE-2026-65595
CVSS Score: 8.9
Published: 2026-07-22

CVE-2026-65595 is a high-severity privilege escalation vulnerability in the Token Exchange module of the n8n visual workflow automation platform. Due to an validation omission, the system unconditionally maps all Public API scopes to session tokens exchanged through trusted Identity Providers, entirely bypassing user-specific role checks.

TL;DR

The n8n Token Exchange module blindly assigns full Public API scopes to exchanged tokens. This allows low-privileged users with a valid external JWT to escalate to administrative status and achieve remote code execution via community package installations.

Technical Details

CWE ID: CWE-269 (Improper Privilege Management)
Attack Vector: Network
CVSS v4.0 Score: 8.9
Vulnerability Type: Privilege Escalation and Remote Code Execution
Exploit Status: None / Proof-of-Concept not publicly released
CISA KEV Status: Not Listed

Affected Systems

n8n Workflow Automation Platform
n8n: < 2.29.8 (Fixed in: 2.29.8)
n8n: >= 2.30.0, < 2.30.1 (Fixed in: 2.30.1)

Mitigation Strategies

Upgrade n8n to version 2.29.8 or 2.30.1 immediately
Disable the Token Exchange module if not strictly required
Disable Public API endpoints to minimize the external attack surface
Restrict the installation of unverified Community Packages

Remediation Steps:

Identify active configurations where both Token Exchange and Public API are enabled
Pull and deploy n8n docker images associated with releases >= 2.29.8 or >= 2.30.1
Configure environment variables to block third-party unverified community packages if patching is delayed