CVE-2026-65595 | n8n before 2.30.1 and 2.29.8 assigns all Public API key scop… | CVSS 8.9 HIGH

Description

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

Metadata

CVE ID: CVE-2026-65595
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-22 10:45 UTC
Published: 2026-07-22 11:21 UTC
Last updated: 2026-07-22 11:21 UTC
Primary CWE: CWE-269
Improper Privilege Management
Vendor / Product: n8n-io / n8n
Sources: cve.org · NVD

Severity & Metrics

8.9 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

Affected products (2)

Vendor	Product	Platform	Versions
n8n-io	n8n	—	0 < 2.30.1, 2.30.1
n8n-io	n8n	—	0 < 2.29.8, 2.29.8

Weakness (CWE)

CWE	Source	Description
CWE-269	cna	Improper Privilege Management

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.9	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

References (2)

GitHub Security Advisory (GHSA-777w-rpr6-c52h) https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h
VulnCheck Advisory: n8n before 2.30.1 Privilege Escalation via Token Exchange https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange