CVE-2026-65016: Authorization Bypass Through User-Controlled Key in n8n-io n8n
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.
AI Analysis
Technical Summary
CVE-2026-65016 is a privilege escalation vulnerability in n8n's Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but fails to prevent assignment of the global:owner role, unlike the token-exchange identity path which rejects it. An attacker who can control the instance-role claim issued by the IdP and with instance-role provisioning enabled (via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE) can escalate privileges to global owner, gaining full administrative control over workflows, credentials, users, and instance configuration. This affects n8n versions prior to 1.123.64, 2.29.8, and 2.30.1.
Potential Impact
An attacker with SSO authentication and control over the instance-role claim can escalate privileges to global owner, gaining full administrative access to the n8n instance. This includes control over workflows, credentials, users, and instance configuration, potentially leading to complete compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Exploitation requires that Enterprise SSO is configured and instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE, which is disabled by default. Until a patch or official fix is available, ensure instance-role provisioning is disabled if not required and carefully validate IdP role claims to prevent unauthorized global:owner assignments.
CVE-2026-65016: Authorization Bypass Through User-Controlled Key in n8n-io n8n
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.
CVSS v4.0
Score 7.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-65016 is a privilege escalation vulnerability in n8n's Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but fails to prevent assignment of the global:owner role, unlike the token-exchange identity path which rejects it. An attacker who can control the instance-role claim issued by the IdP and with instance-role provisioning enabled (via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE) can escalate privileges to global owner, gaining full administrative control over workflows, credentials, users, and instance configuration. This affects n8n versions prior to 1.123.64, 2.29.8, and 2.30.1.
Potential Impact
An attacker with SSO authentication and control over the instance-role claim can escalate privileges to global owner, gaining full administrative access to the n8n instance. This includes control over workflows, credentials, users, and instance configuration, potentially leading to complete compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Exploitation requires that Enterprise SSO is configured and instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE, which is disabled by default. Until a patch or official fix is available, ensure instance-role provisioning is disabled if not required and carefully validate IdP role claims to prevent unauthorized global:owner assignments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-21T11:32:54.897Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60ab919c2644c7f8ece86d
Added to database: 07/22/2026, 11:37:53 UTC
Last enriched: 07/22/2026, 11:52:55 UTC
Last updated: 07/23/2026, 02:51:54 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.