Which versions of n8n are affected by CVE-2026-65595?

n8n workflow-automation instances with both Token Exchange and Public API modules enabled are vulnerable to privilege escalation and remote code execution when low-privileged users possess valid…. A patch is available.

How to fix or mitigate CVE-2026-65595?

Within 24 hours, audit all n8n deployments to identify instances where both Token Exchange and Public API modules are enabled, and document configured JWT issuers. Within 7 days, implement compensating controls: disable the Token Exchange module if operationally feasible, or restrict JWT token issuers to pre-approved trusted identity providers; disable unverified Community Package installation; and enable comprehensive audit logging for administrative operations. Within 30 days, monitor vendor security advisories for patch availability and prepare for immediate deployment once available.

n8n CVE-2026-65595

Q: What is the CVSS score of CVE-2026-65595?

CVE-2026-65595 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-47639 HIGH

Improper Privilege Management (CWE-269)

2026-07-22 VulnCheck

GHSA-wq64-hcrf-8m56

GHSA-777w-rpr6-c52h

Microsoft RCE Privilege Escalation N8n

8.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable and low-privileged (PR:L), but obtaining a trusted external JWT is an added requirement so AC:H; privilege escalation and RCE cross a trust boundary so S:C with full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 13:02 EUVD

Analysis Generated

Jul 22, 2026 - 12:23 vuln.today

CVE Published

Jul 22, 2026 - 11:21 cve.org

HIGH 8.9

DescriptionCVE.org

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

AnalysisAI

Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.

Technical ContextAI

n8n is a source-available workflow automation platform (fair-code) whose Public API exposes privileged administrative endpoints (user management, roles, etc.) gated by API-key scopes. The Token Exchange module lets an external, issuer-signed JWT be exchanged for an n8n access token, effectively federating identity from a trusted issuer. The root cause is CWE-269 (Improper Privilege Management): the scope-assignment logic for Token-Exchange-issued JWTs statically attaches every Public API scope rather than deriving scopes from the authenticated user's role, so the resulting access token over-privileges the bearer. The RCE path leverages n8n's Community Package installation feature - when it permits unverified/unsigned packages, a caller who can drive package installation can execute code within the n8n process.

RemediationAI

Upgrade to a fixed release: n8n 2.30.1 (current line) or 2.29.8 (maintenance line) per the vendor advisory GHSA-777w-rpr6-c52h. Where immediate upgrade is not possible, disable the Token Exchange module, which removes the vulnerable JWT issuance path entirely at the cost of any federated token-exchange login integrations; alternatively disable the Public API, which blocks the administrative endpoints the over-scoped token abuses but breaks any automation relying on the Public API. To specifically cut the RCE path, disable unverified Community Package installation so untrusted packages cannot be installed. As a network control, restrict access to the Public API and Token Exchange endpoints to trusted management networks. Confirm exact configuration flag names against the vendor advisory before applying, and validate that any external issuer trusted by Token Exchange is tightly scoped.