CVE-2026-65016 n8n-io CVE debrief

Who should care

Users of n8n versions before 1.123.64, 2.29.8, and 2.30.1 who have configured Enterprise SSO and enabled instance-role provisioning via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE should be aware of this vulnerability. Administrators of affected instances should take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in the Enterprise SSO instance-role provisioning feature of n8n. The feature maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role. This allows an SSO-authenticated user to gain full administrative control over workflows, credentials, users, and instance configuration if their instance-role claim resolves to global:owner. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

Defensive priority

High

Recommended defensive actions

• Update to a patched version of n8n (1.123.64, 2.29.8, or 2.30.1) immediately.
• Disable instance-role provisioning via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE if not required.
• Monitor instance-role claims issued by the IdP for suspicious activity.
• Implement compensating controls to restrict administrative access.
• Review instance configurations for any suspicious changes.
• Verify that instance-role claims are properly validated and sanitized.
• Conduct regular security audits to detect potential exploitation attempts.

Evidence notes

The CVE record was published on 2026-07-22T12:18:18.733Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. The vulnerability was disclosed by Vulncheck via CVE.org.

Official resources