Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-65595: n8n Public API Key Privilege Escalation via Token Exchange
CVE-2026-65595 · published 7 days ago
Summary
A low-privileged user can gain elevated access to n8n's Public API, potentially allowing them to create, delete, or escalate user roles. This can happen if a malicious user obtains a valid external token that n8n trusts. To mitigate this, update n8n to version 2.30.1 or later.
What to do
- Update GitHub Actions n8n to version 2.30.1.
- Update GitHub Actions n8n to version 2.29.8.
- Update n8n to version 2.19.3-aikido.10.
- Update rootio @rootio/n8n to version 2.19.3-root.io.10.
- Update n8n to version 2.19.3-aikido.11.
- Update rootio @rootio/n8n to version 2.19.3-root.io.11.
- Update n8n to version 2.19.3-aikido.12.
- Update rootio @rootio/n8n to version 2.19.3-root.io.12.
- Update n8n to version 2.19.3-aikido.13.
- Update rootio @rootio/n8n to version 2.19.3-root.io.13.
- Update n8n to version 2.19.3-aikido.15.
- Update rootio @rootio/n8n to version 2.19.3-root.io.15.
- Update n8n n8n to version 2.29.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | n8n-io | n8n |
< 2.30.1 < 2.29.8 |
| npm | GitHub Actions | n8n |
>= 2.30.0, < 2.30.1 < 2.29.8 Fix: upgrade to 2.30.1
|
| – | n8n | n8n |
< 2.29.8 2.30.0 cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:* |
| Root:npm | – | n8n |
< 2.19.3-aikido.10 < 2.19.3-aikido.11 < 2.19.3-aikido.12 < 2.19.3-aikido.13 < 2.19.3-aikido.15 Fix: upgrade to 2.19.3-aikido.10
|
| Root:npm | rootio | @rootio/n8n |
< 2.19.3-root.io.10 < 2.19.3-root.io.11 < 2.19.3-root.io.12 < 2.19.3-root.io.13 < 2.19.3-root.io.15 Fix: upgrade to 2.19.3-root.io.10
|
Original advisory text
CVE-2026-65595 in n8n - Patched by Root
Root has patched CVE-2026-65595 in the n8n package for Root:npm. Multiple fixed versions available.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h Mitigation Vendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-e... Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-65595
- https://github.com/n8n-io/n8n/releases/tag/[email protected]
- https://github.com/n8n-io/n8n/releases/tag/[email protected]
- https://github.com/advisories/GHSA-777w-rpr6-c52h
- https://github.com/n8n-io/n8n Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.9
High
Type
CWE-269Improper Privilege Management
Timeline
Published6 Oct 2026
Updated11 Oct 2026
First seen22 Jul 2026
Sources
CVE-2026-65595 · NVD
CVE-2026-65595 · MITRE
GHSA-777w-rpr6-c52h · GHSA
GHSA-777w-rpr6-c52h · OSV
Track software like this
Free during beta