Vulnerability · Published Jul 22, 2026 · Assigned by VulnCheck

CVE-2026-65595n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange

High 8.9

In plain English

A high-severity privilege mismanagement in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.7%top 46.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	n8n	2.30.1	GHSA-777w-rpr6-c52h
npm	n8n	2.29.8	GHSA-777w-rpr6-c52h

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	2.30.0 – before 2.30.1
n8n-io	n8n	0 – before 2.29.8

Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

References

GitHub Security Advisory (GHSA-777w-rpr6-c52h) vendor-advisory
VulnCheck Advisory: n8n before 2.30.1 Privilege Escalation via Token Exchange third-party-advisory