PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65016 n8n-io CVE debrief

CVE-2026-65016 is a high-severity privilege escalation vulnerability in n8n versions before 1.123.64, 2.29.8, and 2.30.1. The vulnerability exists in the Enterprise SSO instance-role provisioning feature, which maps an IdP-asserted role claim to an n8n global role without preventing assignment of the global:owner role. This allows an SSO-authenticated user to gain full administrative control over workflows, credentials, users, and instance configuration if their instance-role claim resolves to global:owner.

Vendor
n8n-io
Product
n8n
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-27
Advisory published
2026-07-22
Advisory updated
2026-07-27

Who should care

Users of n8n versions before 1.123.64, 2.29.8, and 2.30.1 who have configured Enterprise SSO and enabled instance-role provisioning via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE should be aware of this vulnerability. Administrators of affected instances should take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in the Enterprise SSO instance-role provisioning feature of n8n. The feature maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role. This allows an SSO-authenticated user to gain full administrative control over workflows, credentials, users, and instance configuration if their instance-role claim resolves to global:owner. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

Defensive priority

High

Recommended defensive actions

  • Update to a patched version of n8n (1.123.64, 2.29.8, or 2.30.1) immediately.
  • Disable instance-role provisioning via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE if not required.
  • Monitor instance-role claims issued by the IdP for suspicious activity.
  • Implement compensating controls to restrict administrative access.
  • Review instance configurations for any suspicious changes.
  • Verify that instance-role claims are properly validated and sanitized.
  • Conduct regular security audits to detect potential exploitation attempts.

Evidence notes

The CVE record was published on 2026-07-22T12:18:18.733Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. The vulnerability was disclosed by Vulncheck via CVE.org.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65016 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65016

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65016 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65016

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.