CVE-2026-72772 n8n-io CVE debrief

Who should care

Defenders managing n8n instances, especially those using the embed login feature with trusted key sources, should assess their exposure and verify authentication controls. This includes reviewing user roles, token exchange configurations, and ensuring that trusted key sources are properly restricted. Security teams and vulnerability management teams should prioritize updates or mitigations to prevent unauthorized access and potential full account control.

Why it matters

CVE-2026-72772 is a high-severity vulnerability in n8n that allows for account takeover. Defenders managing n8n instances using the embed login feature should verify their exposure, assess authentication controls, and prioritize updates or mitigations to prevent unauthorized access and potential full account control.

• Potential for attackers to gain unauthorized access to user accounts.
• Risk of full account control for existing users.
• Need for verification of trusted key sources and their role ceilings.
• Priority on updating to secure versions or applying mitigations.

Technical summary

The vulnerability exists in the Token Exchange Embed Login feature of n8n. When a validly-signed incoming token matches a local account by its email claim, the service fails to verify if the email claim was verified or if the trusted key's role ceiling covers that account. This allows anyone with a token accepted by a configured trusted key to authenticate as any existing user, potentially gaining full account control.

Defensive priority

Defenders should prioritize verifying if their n8n instances are using the embed login feature with trusted key sources and assess user authentication controls.

Recommended defensive actions

• Verify if n8n instances use the embed login feature with trusted key sources.
• Assess user authentication controls and token exchange configurations.
• Update to version 2.32.1 or 2.31.5 if vulnerable.
• Review and restrict trusted key sources and their permitted roles.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and affected versions. Vendor advisories offer mitigation guidance. Defenders should verify the authenticity of tokens and the role ceilings of trusted keys. Limited source detail exists on exploitability and specific attack scenarios. Further verification tasks are needed to assess exposure and validate mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.