n8n CVE-2026-65016

Three concrete prerequisites must all hold: (1) n8n Enterprise SSO is configured against an external IdP; (2) instance-role provisioning is explicitly enabled via the environment variable N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE, which is disabled by default; and (3) the attacker can control or influence the instance-role claim value issued by the IdP for their account. Limiting factors that reduce real-world exposure: the attacker must already hold a valid SSO login (PR:L, not anonymous), the feature is off in default installations, and where the IdP tightly governs role claims server-side the attacker cannot set the value to global:owner. There is no user-interaction requirement beyond the attacker's own authentication.

This is a real but conditional privilege-escalation issue rather than a broadly wormable one. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.7 High) is internally consistent with the description: network-reachable, low complexity, but carrying an explicit Attack Requirement (AT:P) and requiring low privileges (PR:L) - the attacker must already be an SSO-authenticated user AND be able to influence the instance-role claim the IdP issues. Impact is maximal (full owner over confidentiality, integrity, and availability of the instance). No EPSS score was provided, and there is no KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The decisive limiter is configuration: instance-role provisioning is disabled by default (N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE), so only deployments that both run Enterprise SSO and have explicitly enabled this feature are exposed. Where the attacker can manipulate IdP claim values (e.g., self-registration, a compromised or loosely-governed IdP, or user-editable attributes mapped to the role claim), real-world risk is high; otherwise it is contained.

An organization runs n8n Enterprise with SSO and has enabled instance-role provisioning. An authenticated but low-privileged SSO user who can influence the role attribute their IdP asserts (for example via a self-editable profile field or a permissive IdP mapping) sets that claim to resolve to global:owner; on their next login n8n provisions them as instance owner, handing them full control over all workflows, stored credentials, and users. No public proof-of-concept has been identified, and low attack complexity is offset by the requirement to control the claim value and the non-default feature flag.