{"id":"EUVD-2026-47632","enisaUuid":"f04bca0d-1b7c-3b0c-90de-31fc0f4cf128","description":"n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.","datePublished":"Jul 22, 2026, 11:21:38 AM","dateUpdated":"Oct 29, 2026, 9:16:20 PM","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role\n","aliases":"CVE-2026-65016\nGHSA-mwq7-vcmc-cm4q\nGHSA-35q8-9mj6-wjmf\n","assigner":"VulnCheck","epss":0.45,"enisaIdProduct":[{"id":"5aff1fdf-5538-3ce2-8ffb-aad3b6129bd6","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"ae31554d-ef8d-357d-93c9-b46c57642230","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"f176cc27-7dbf-396c-9128-5c35b54eaa33","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"}],"enisaIdVendor":[{"id":"a27797e0-e527-3925-952b-9f3a3ddd9f7f","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"0064384c-789a-3cb4-996f-216d4013d8fa","vulnerability":{"id":"GHSA-mwq7-vcmc-cm4q","description":"Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner","datePublished":"Jul 22, 2026, 12:32:17 PM","dateUpdated":"Jul 22, 2026, 10:02:51 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65016\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role\n","enisa_id":"EUVD-2026-47632\n","aliases":"GHSA-mwq7-vcmc-cm4q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b0bf0321-bfe0-31a2-93f1-e42413313729","vulnerability":{"id":"GHSA-35q8-9mj6-wjmf","description":"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner","datePublished":"Jul 22, 2026, 10:04:04 PM","dateUpdated":"Jul 22, 2026, 10:04:04 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65016\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role\n","enisa_id":"EUVD-2026-47632\n","aliases":"GHSA-35q8-9mj6-wjmf\nCVE-2026-65016\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d17d0167-485c-327e-97e1-63f59ddde404","vulnerability":{"id":"CVE-2026-65016","description":"n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.","datePublished":"Jul 22, 2026, 11:21:38 AM","dateUpdated":"Oct 29, 2026, 9:16:20 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role\n","enisa_id":"EUVD-2026-47632\n","assigner":"VulnCheck","epss":0.45,"dataProcessed":"Nov 5, 2026, 7:15:39 AM","vulnerabilityProduct":[{"id":"00327319-fe83-37a1-a29b-dc1ecaca7b0c","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"13821955-5368-3065-a1ab-311b0a200045","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"29f6a4ff-6587-332d-8855-54ab884cf0b9","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"}],"vulnerabilityVendor":[{"id":"f03e285d-da78-3ca2-8f7e-9b2fd8ff7b3f","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[]}