CVE-2026-65016

Analyzed Analyzed - Analysis Complete

Privilege Escalation in n8n via SSO Role Provisioning

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65016

EUVD

EUVD-2026-47632

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	2.30.0
n8n	n8n	2.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-65016 is a privilege escalation vulnerability in n8n's Enterprise SSO instance-role provisioning feature. It allows an attacker to gain full administrative control over an n8n instance by exploiting how SSO-authenticated roles are mapped to global roles. The vulnerability exists because the provisioning path does not prevent assignment of the global:owner role, unlike the token-exchange identity path.

Detection Guidance

Check if Enterprise SSO is configured with instance-role provisioning enabled by verifying the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE flag. Review IdP claim mappings to ensure instance-role claims cannot be manipulated to assign global:owner. Inspect n8n instance logs for unusual administrative actions or unauthorized role assignments.

Impact Analysis

An attacker exploiting this vulnerability could gain full administrative control over an n8n instance. This includes access to workflows, credentials, users, and instance configuration. Exploitation requires Enterprise SSO to be configured, instance-role provisioning enabled, and the attacker to control the instance-role claim value from the Identity Provider.

Compliance Impact

This vulnerability allows an attacker to gain full administrative control over an n8n instance, which could lead to unauthorized access to sensitive data processed by workflows. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) if such data is exposed or mishandled due to the breach.

Mitigation Strategies

Upgrade n8n to versions 1.123.64, 2.29.8, or 2.30.1 or later. Disable instance-role provisioning by setting N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE to false. Audit and restrict IdP claim mappings to prevent global:owner role assignment. Limit SSO access to trusted users only.

Hi! I’m here to help you understand CVE-2026-65016. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70