CVE-2026-65595: n8n Token Exchange bug grants admin

Q: Is CVE-2026-65595 actively exploited?

No confirmed active exploitation of CVE-2026-65595 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65595?

1) Upgrade to n8n 2.30.1 or 2.29.8 (or later) immediately. 2) If patching is delayed, disable the Token Exchange module and/or the Public API on instances that don't strictly need both enabled together. 3) Disable unverified Community Package installation instance-wide to eliminate the RCE escape hatch regardless of patch status. 4) Review configured Token Exchange issuers and tighten trust to only necessary identity providers. 5) Audit Public API activity logs and the users table for unexpected role changes, newly created admin accounts, or recent community package installs. 6) Rotate Public API keys and re-verify Advanced Permissions license role assignments post-patch.

Q: What systems are affected by CVE-2026-65595?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

Q: What is the CVSS score for CVE-2026-65595?

No CVSS score has been assigned yet.

CISO Take

A flaw in n8n's Token Exchange module issues JWTs with full Public API admin scopes regardless of the requesting user's actual role, meaning any low-privileged user who can obtain an external JWT trusted by a configured issuer can call administrator-only endpoints. This matters because n8n is a widely deployed AI agent orchestration platform (16 downstream dependents in our tracking) and the resulting access token lets an attacker escalate their own role, create or delete users, and — where unverified Community Package installation is enabled — achieve remote code execution on the host. There is no CVSS score, EPSS percentile, CISA KEV listing, public exploit, or scanner template available yet, so exploitation likelihood cannot be quantified today, but the impact ceiling (full admin takeover plus RCE) is severe for any self-hosted instance exposing both the Public API and Token Exchange. Patch immediately to n8n 2.30.1 or 2.29.8; until patched, disable the Token Exchange feature or the Public API if not strictly required, and disable unverified Community Package installation to remove the RCE escape hatch. Audit recent Public API activity (role changes, new admin users, package installs) for signs of abuse.

Sources: NVD GitHub Advisory CISA KEV OpenSSF ATLAS vulncheck.com

What is the risk?

Severity is currently unscored (no CVSS/EPSS/KEV data), but the technical impact is high: a low-privileged, authenticated actor can obtain admin-equivalent API access and chain it to RCE. Exploitability depends on two gating conditions — Token Exchange must be enabled and the attacker must be able to obtain a JWT from an issuer the n8n instance trusts — which limits blast radius versus a fully unauthenticated bug, but the CWE-269 (improper privilege management) root cause is straightforward to exploit once those conditions hold, with no complex crafting required. No public exploit or Nuclei template exists yet and it is not in CISA KEV, so treat this as high-priority-but-not-yet-weaponized.

How does the attack unfold?

Initial Access

A low-privileged n8n user obtains a valid external JWT from an identity provider trusted by the instance's Token Exchange configuration.

AML.T0091.000

Privilege Escalation

The user exchanges the JWT for an n8n Public API access token, which is incorrectly issued with full administrator scopes regardless of their actual role.

AML.T0047

Admin Abuse

Using the over-privileged token, the attacker calls admin-only Public API endpoints to escalate their role, create new admin users, or delete existing accounts.

Remote Code Execution

With admin access, the attacker installs a malicious unverified Community Package, achieving arbitrary code execution on the n8n host and compromising all connected credentials and AI tools.

AML.T0011.001

Initial Access

A low-privileged n8n user obtains a valid external JWT from an identity provider trusted by the instance's Token Exchange configuration.

AML.T0091.000

Privilege Escalation

The user exchanges the JWT for an n8n Public API access token, which is incorrectly issued with full administrator scopes regardless of their actual role.

AML.T0047

Admin Abuse

Using the over-privileged token, the attacker calls admin-only Public API endpoints to escalate their role, create new admin users, or delete existing accounts.

Remote Code Execution

With admin access, the attacker installs a malicious unverified Community Package, achieving arbitrary code execution on the n8n host and compromising all connected credentials and AI tools.

AML.T0011.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.30.0, < 2.30.1	`2.30.1`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade to n8n 2.30.1 or 2.29.8 (or later) immediately. 2) If patching is delayed, disable the Token Exchange module and/or the Public API on instances that don't strictly need both enabled together. 3) Disable unverified Community Package installation instance-wide to eliminate the RCE escape hatch regardless of patch status. 4) Review configured Token Exchange issuers and tighten trust to only necessary identity providers. 5) Audit Public API activity logs and the users table for unexpected role changes, newly created admin accounts, or recent community package installs. 6) Rotate Public API keys and re-verify Advanced Permissions license role assignments post-patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent API AML.T0011.001 - Malicious Package AML.T0047 - AI-Enabled Product or Service AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - Access control for AI system components

NIST AI RMF

MANAGE-4.1 - Risk controls for third-party and plugin components

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-65595?

A flaw in n8n's Token Exchange module issues JWTs with full Public API admin scopes regardless of the requesting user's actual role, meaning any low-privileged user who can obtain an external JWT trusted by a configured issuer can call administrator-only endpoints. This matters because n8n is a widely deployed AI agent orchestration platform (16 downstream dependents in our tracking) and the resulting access token lets an attacker escalate their own role, create or delete users, and — where unverified Community Package installation is enabled — achieve remote code execution on the host. There is no CVSS score, EPSS percentile, CISA KEV listing, public exploit, or scanner template available yet, so exploitation likelihood cannot be quantified today, but the impact ceiling (full admin takeover plus RCE) is severe for any self-hosted instance exposing both the Public API and Token Exchange. Patch immediately to n8n 2.30.1 or 2.29.8; until patched, disable the Token Exchange feature or the Public API if not strictly required, and disable unverified Community Package installation to remove the RCE escape hatch. Audit recent Public API activity (role changes, new admin users, package installs) for signs of abuse.

Is CVE-2026-65595 actively exploited?

No confirmed active exploitation of CVE-2026-65595 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65595?

1) Upgrade to n8n 2.30.1 or 2.29.8 (or later) immediately. 2) If patching is delayed, disable the Token Exchange module and/or the Public API on instances that don't strictly need both enabled together. 3) Disable unverified Community Package installation instance-wide to eliminate the RCE escape hatch regardless of patch status. 4) Review configured Token Exchange issuers and tighten trust to only necessary identity providers. 5) Audit Public API activity logs and the users table for unexpected role changes, newly created admin accounts, or recent community package installs. 6) Rotate Public API keys and re-verify Advanced Permissions license role assignments post-patch.

What systems are affected by CVE-2026-65595?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-65595?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0011.001 Malicious Package

AML.T0047 AI-Enabled Product or Service

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.

Exploitation Scenario

A contractor or low-privileged employee with a standard n8n account obtains a valid JWT from an identity provider that the organization has configured as a trusted Token Exchange issuer (e.g., their normal SSO login token). They exchange it through n8n's Token Exchange endpoint for a Public API access token — which, due to the bug, carries full administrator scopes instead of being limited to their actual role. Using this token, they call admin-only Public API endpoints to grant themselves the Owner role (if Advanced Permissions is licensed) or create a new admin user. With admin access secured, they enable and install a malicious Community Package disguised as a workflow utility, which executes arbitrary Node.js code on the n8n host — giving them access to every stored credential, API key, and connected AI service the instance orchestrates.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.