CVEvulnerability

CVE-2026-65595

8.9 HIGH Published 2026-07-22 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-07-22
Last modified
2026-10-24
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.9 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269

Description

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

Affected configurations

• n8n n8n (< 2.29.8) • n8n n8n 2.30.0

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References