CVE-2026-65595

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Disable the Token Exchange feature by setting N8N_TOKEN_EXCHANGE_ENABLED=false or N8N_ENV_FEAT_TOKEN_EXCHANGE=false.
• If Token Exchange cannot be disabled, restrict Public API access at the network level to trusted clients only.
• Disable unverified Community Package installation by setting N8N_UNVERIFIED_PACKAGES_ENABLED=false to eliminate the code execution path.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke administrator-only Public API operations, such as role escalation, user creation, and user deletion.

The issue only affects instances where the Token Exchange feature and the Public API are enabled (N8N_TOKEN_EXCHANGE_ENABLED=true, N8N_ENV_FEAT_TOKEN_EXCHANGE=true) and the attacker can obtain an external JWT accepted by a configured trusted key. Role escalation additionally requires an Advanced Permissions license; Community Package installation additionally requires N8N_COMMUNITY_PACKAGES_ENABLED=true and N8N_UNVERIFIED_PACKAGES_ENABLED=true.

The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.

Kodem intelligence

Already deployed Kodem?

The issue has been fixed in n8n version 2.30.1 and 2.29.8. Users should upgrade to this version or later to remediate the vulnerability.

1. What is CVE-2026-65595? CVE-2026-65595 is a high-severity improper privilege management vulnerability in n8n (npm), affecting versions >= 2.30.0, < 2.30.1. It is fixed in 2.30.1, 2.29.8. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
2. Which versions of n8n are affected by CVE-2026-65595? n8n (npm) versions >= 2.30.0, < 2.30.1 is affected.
3. Is there a fix for CVE-2026-65595? Yes. CVE-2026-65595 is fixed in 2.30.1, 2.29.8. Upgrade to this version or later.
4. Is CVE-2026-65595 exploitable, and should I be worried? Whether CVE-2026-65595 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-65595 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-65595?
   • Upgrade n8n to 2.30.1 or later
   • Upgrade n8n to 2.29.8 or later

Other vulnerabilities in n8n