EUVD-2026-47638
GHSA-5vfw-jc4p-fj39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required member account; S:C and C:H because the token conveys owner's project context and integration credentials; I:L for attacker-controlled workflow inputs.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation.
AnalysisAI
Broken authorization in n8n's OAuth 2.1 consent flow allows a member-level authenticated user to self-approve OAuth consent for workflows they do not own, then execute those workflows in the victim owner's project context using the owner's stored credentials. Versions 2.27.0 through 2.29.7 and 2.30.0 are affected - the flaw was introduced precisely when the OAuth 2.1 MCP Server Trigger flow was added. On multi-user instances with at least one OAuth2-enabled MCP Server Trigger workflow, the attacker obtains a valid token, drives the workflow with attacker-controlled inputs, and reads outputs that may include sensitive data exfiltrated from the owner's connected third-party integrations, breaking both user and project isolation. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Technical ContextAI
n8n is a self-hostable, open-source workflow automation platform (CPE: cpe:2.3:a:n8n-io:n8n). Version 2.27.0 introduced an OAuth 2.1 authorization server to support MCP (Model Context Protocol) Server Trigger nodes, allowing external OAuth clients to authorize against specific n8n workflows as the protected resource. The root cause is CWE-863 (Incorrect Authorization): the OAuth consent and token-issuance endpoint accepts a workflow ID as the resource parameter but does not verify that the authenticated requester is the owner of - or has been granted access to - that workflow. Any member-level user can therefore register an OAuth client, present an arbitrary workflow ID during the authorization request, self-approve the consent screen, and receive a fully valid access token. The token then conveys the workflow owner's project context, including the owner's credential store for connected integrations.
RemediationAI
Upgrade n8n to version 2.29.8 (for the 2.29.x track) or 2.30.1 (for the 2.30.x track), as confirmed by the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf. If an immediate upgrade is operationally blocked, the most effective compensating control is to disable all MCP Server Trigger workflows that use n8n OAuth2 authentication - this removes the attack prerequisite entirely and eliminates exploitability at the cost of losing MCP-based OAuth automation. A secondary mitigation is to audit instance membership and remove or downgrade any member-level accounts that should not have visibility into other users' workflows; however, this does not patch the underlying authorization flaw and is not a substitute for upgrading. Additional context and references are available at https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today