CVE-2026-65595: n8n Privilege Escalation And Code Execution Vulnerability
HIGHCVE-2026-65595 is a HIGH privilege escalation and code execution vulnerability (CWE-269: Improper Privilege Management) affecting n8n libraries in the npm ecosystem. The issue involves privilege escalation and code execution via full public api key scope assignment to token exchange jwts. Remediation is available by upgrading affected packages to version 2.30.1, 2.29.8.
CVE-2026-65595 at a Glance
How to Fix CVE-2026-65595
To remediate this vulnerability, upgrade all affected n8n dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install n8n@2.30.1npm install n8n@2.29.8Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls n8nHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-65595, inspect your project dependencies using npm:
npm ls n8nAnalyze the terminal output to locate any version of n8n in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.30.1), your application is affected.
Note: The npm ls n8n command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-269: Improper Privilege Management, where the product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. In n8n, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-65595 Affected n8n Versions
2 component(s)References
Frequently Asked Questions
What is CVE-2026-65595?
Which n8n versions are affected?
What version fixes CVE-2026-65595?
Is n8n affected?
What CWE is associated with CVE-2026-65595?
How can I check npm dependencies for CVE-2026-65595?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-777w-rpr6-c52h",
"modified" : "2026-07-22T22:00:07Z",
"published" : "2026-07-22T22:00:07Z",
"aliases" : [ "CVE-2026-65595" ],
"summary" : "n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",
"details" : "## Impact\n\nJWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke administrator-only Public API operations, such as role escalation, user creation, and user deletion.\n\nThe issue only affects instances where the Token Exchange feature and the Public API are enabled (N8N_TOKEN_EXCHANGE_ENABLED=true, N8N_ENV_FEAT_TOKEN_EXCHANGE=true) and the attacker can obtain an external JWT accepted by a configured trusted key. Role escalation additionally requires an Advanced Permissions license; Community Package installation additionally requires `N8N_COMMUNITY_PACKAGES_ENABLED=true` and `N8N_UNVERIFIED_PACKAGES_ENABLED=true`.\n\n## Patches\n\nThe issue has been fixed in n8n version 2.30.1 and 2.29.8. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the Token Exchange feature by setting `N8N_TOKEN_EXCHANGE_ENABLED=false` or `N8N_ENV_FEAT_TOKEN_EXCHANGE=false`.\n- If Token Exchange cannot be disabled, restrict Public API access at the network level to trusted clients only.\n- Disable unverified Community Package installation by setting `N8N_UNVERIFIED_PACKAGES_ENABLED=false` to eliminate the code execution path.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "n8n"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.30.0"
}, {
"fixed" : "2.30.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "n8n"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.29.8"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-65595"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/n8n-io/n8n"
}, {
"type" : "WEB",
"url" : "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
}, {
"type" : "WEB",
"url" : "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
}, {
"type" : "WEB",
"url" : "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-269" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-22T22:00:07Z",
"nvd_published_at" : null
}
}