CVE-2026-65594: Incorrect Authorization in n8n-io n8n
n8n versions from 2.27.0 up to but not including 2.29.8, and versions 2.30.0 up to but not including 2.30.1, contain an incorrect authorization vulnerability. This flaw allows a member-level user to register an OAuth client and self-approve consent for another user's workflow, gaining unauthorized access to that workflow's context and credentials. Consequently, the attacker can execute workflows with the owner's privileges, potentially accessing sensitive data from connected integrations and breaking user and project isolation.
AI Analysis
Technical Summary
CVE-2026-65594 is an incorrect authorization vulnerability in n8n introduced in version 2.27.0 with the OAuth 2.1 consent and token-issuance flow. The software fails to verify that the authenticated user has access rights to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. This token allows the attacker to run the workflow in the owner's project context using the owner's stored credentials, enabling the attacker to set tool inputs and read outputs, thereby breaking user and project isolation.
Potential Impact
An attacker with member-level access can escalate privileges by obtaining OAuth tokens for workflows owned by other users. This enables unauthorized execution of workflows with the owner's credentials, potentially exposing sensitive data from connected integrations and violating user and project isolation boundaries. The vulnerability undermines the integrity of access controls within affected n8n instances.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict member-level user permissions to prevent unauthorized OAuth client registration and workflow access. Monitor for updates from n8n-io regarding patches or official mitigations addressing this vulnerability.
CVE-2026-65594: Incorrect Authorization in n8n-io n8n
Description
n8n versions from 2.27.0 up to but not including 2.29.8, and versions 2.30.0 up to but not including 2.30.1, contain an incorrect authorization vulnerability. This flaw allows a member-level user to register an OAuth client and self-approve consent for another user's workflow, gaining unauthorized access to that workflow's context and credentials. Consequently, the attacker can execute workflows with the owner's privileges, potentially accessing sensitive data from connected integrations and breaking user and project isolation.
CVSS v4.0
Score 5.1medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-65594 is an incorrect authorization vulnerability in n8n introduced in version 2.27.0 with the OAuth 2.1 consent and token-issuance flow. The software fails to verify that the authenticated user has access rights to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. This token allows the attacker to run the workflow in the owner's project context using the owner's stored credentials, enabling the attacker to set tool inputs and read outputs, thereby breaking user and project isolation.
Potential Impact
An attacker with member-level access can escalate privileges by obtaining OAuth tokens for workflows owned by other users. This enables unauthorized execution of workflows with the owner's credentials, potentially exposing sensitive data from connected integrations and violating user and project isolation boundaries. The vulnerability undermines the integrity of access controls within affected n8n instances.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict member-level user permissions to prevent unauthorized OAuth client registration and workflow access. Monitor for updates from n8n-io regarding patches or official mitigations addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-22T10:45:44.832Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60ab939c2644c7f8eced3d
Added to database: 07/22/2026, 11:37:55 UTC
Last enriched: 07/30/2026, 04:22:58 UTC
Last updated: 09/04/2026, 10:52:10 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.