SSO Instance-Role Provisioning Privilege Escalation in n8n (CVE-2026-65016)

n8n's Enterprise SSO instance-role provisioning does not prevent assignment of the global:owner role, allowing an SSO-authenticated user with a controlled instance-role claim to escalate privileges to instance owner. This grants full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires Enterprise SSO configuration, enabled instance-role provisioning (disabled by default), and attacker control of the IdP claim. Affected versions: - 1.123.64 - 2.29.8 - 2.30.1 We recommend updating to: 1.123.64, 2.29.8, 2.30.1. CVSS 7.7 · our assessment: this_week Reference: https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf Details: https://vuln.today/cve/CVE-2026-65016