CVE-2026-72772 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, particularly those with the embed login feature enabled, should assess exposure and verify that trusted key sources are properly configured to prevent unauthorized account takeovers.

Why it matters

CVE-2026-72772 is a high-severity vulnerability in n8n that allows for account takeover through the Token Exchange Embed Login feature. Defenders should prioritize verifying instances with the embed login feature enabled and ensuring proper configuration of trusted key sources to prevent unauthorized account takeovers.

• Potential for unauthorized account takeovers
• Possible lateral movement within n8n instances
• Need for verification of trusted key source configurations
• Requirement for updating n8n to a secure version

Technical summary

The vulnerability exists in the Token Exchange Embed Login feature of n8n, allowing an attacker to take over any existing user account if they can obtain a token accepted by a configured trusted key. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured. The service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key could authenticate as any existing user and gain full account control.

Defensive priority

Defenders should prioritize verifying instances of n8n with the embed login feature enabled and ensuring that trusted key sources are properly configured to prevent unauthorized account takeovers.

Recommended defensive actions

• Verify instances of n8n with the embed login feature enabled
• Ensure trusted key sources are properly configured
• Update n8n to version 2.32.1 or later
• Review and restrict access to the embed login feature
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 8.9 and the affected versions of n8n. However, additional information on exploitation or affected systems is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.