n8n CVE-2026-65594

Two concrete prerequisites must both be true: (1) the n8n instance must have at least one MCP Server Trigger workflow actively configured with n8n OAuth2 authentication - this is a deliberately enabled, non-default feature that an administrator must set up; (2) the attacker must hold a valid member-level (or higher) authenticated account on the same instance. Exploitation is not possible against instances with no OAuth2-enabled MCP Server Trigger workflows, instances where only a single trusted user exists, or instances where all members share equivalent trust boundaries. The CVSS 4.0 AT:P metric formally encodes the configuration prerequisite as a limiting factor. What the vulnerability does NOT require: administrative privileges, any user interaction from the victim, or any special network position beyond authenticated access to the n8n web interface.

The CVSS 4.0 score of 5.1 is driven primarily by AT:P (attack prerequisites), reflecting that exploitation requires a non-default, administrator-configured condition: at least one active MCP Server Trigger workflow with n8n OAuth2 authentication must exist. Without this prerequisite the attack surface is zero. PR:L confirms a valid member-level account is mandatory, ruling out unauthenticated exploitation. Despite the moderate aggregate score, the SC:H (subsequent-system high confidentiality impact) is the most significant signal: a successful attacker can read the workflow owner's integration outputs, which may include credentials, API responses, database records, or email content from connected services. This privilege-escalation-to-data-exfiltration path is a material risk on any shared or multi-tenant n8n deployment. No CISA KEV listing and no public exploit code exist at time of analysis; EPSS data was not supplied. For single-user instances or deployments where all members are equally trusted, real-world risk is low. For organizations running n8n as a shared automation platform with role-based project separation, the risk is high relative to the CVSS score because the confidentiality impact touches cross-project credential material.

A member-level user on a shared company n8n instance identifies that an administrator has an active MCP Server Trigger workflow connected to a CRM and internal email system using n8n OAuth2. The attacker registers an OAuth client in the n8n instance, initiates the OAuth 2.1 authorization flow with the administrator's workflow ID as the resource, and self-approves the consent prompt - the server issues a valid token without verifying ownership. The attacker then invokes the workflow with crafted tool inputs and reads the output, obtaining CRM records and email content from the administrator's connected integrations without ever having been granted access to the workflow or its underlying credentials. No public exploit code has been identified at time of analysis.