CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.

• CWE-639

• https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmfMitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-roleThird Party Advisory

Published

Jul 22, 2026

Last Modified

Jul 27, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65010Datasets through 5.00, fixed in commit ad2d853, contains a s…6.6
• CVE-2026-65011Graylog2 Server before commit 46a2eeb contains a missing per…5.3
• CVE-2026-65012InvokeAI before 6.13.7 contains an unauthenticated directory…6.3
• CVE-2026-65013Onlook through 0.2.32, fixed in commit 423e2e9, contains a b…8.8
• CVE-2026-65014n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) r…5.3
• CVE-2026-65015n8n versions before 2.30.1 contain a privilege escalation vu…8.8
• CVE-2026-65017Apache Airflow's Config API did not mask team-scoped sensiti…6.5
• CVE-2026-6504The Royal Elementor Addons and Templates plugin for WordPres…6.4
• CVE-2026-65048Ninja Forms plugin for WordPress versions 3.10.4 through 3.1…9.3
• CVE-2026-65049Ninja Forms plugin version 3.14.8 and prior for WordPress Mu…9.3
• CVE-2026-6505The ACAP framework contains a Time-of-Check to Time-of-Use (…5.1
• CVE-2026-65050Ninja Forms WordPress plugin version 3.14.8 and prior contai…7.1