CVE-2026-65595

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8

Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens (JWTs), ignoring the actual role of the acting user. In environments where the Token Exchange feature and Public API are enabled, a low-privileged user with a valid external JWT from a trusted issuer can use the resulting access token to perform administrator-only Public API operations, including user creation, user deletion, and role escalation. Furthermore, if unverified Community Package installation is enabled, this can lead to remote code execution.

Recommendations Update to version 2.30.1 or later. Update to version 2.29.8 or later. Disable the Token Exchange feature by setting N8N TOKEN EXCHANGE ENABLED=false or N8N ENV FEAT TOKEN EXCHANGE=false. Restrict Public API access at the network level to trusted clients only. Disable unverified Community Package installation by setting N8N UNVERIFIED PACKAGES ENABLED=false.