CVE-2026-65594 Overview
CVE-2026-65594 is a missing authorization vulnerability in n8n, a workflow automation platform. The flaw affects n8n versions from 2.27.0 up to 2.29.8, and 2.30.x before 2.30.1. The issue was introduced when the OAuth 2.1 consent and token-issuance flow was added in 2.27.0. n8n fails to verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can self-approve consent for another user's workflow and obtain a valid token, breaking user and project isolation.
Critical Impact
A low-privileged member can invoke another user's MCP Server Trigger workflows in the owner's project context, using the owner's stored credentials to read outputs from connected integrations.
Affected Products
- n8n versions 2.27.0 through 2.29.7
- n8n 2.30.0 (fixed in 2.30.1)
- Instances running at least one active MCP Server Trigger workflow with n8n OAuth2 authentication
Discovery Timeline
- 2026-07-22 - CVE-2026-65594 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-65594
Vulnerability Analysis
The vulnerability is an authorization flaw classified under [CWE-863] Incorrect Authorization. n8n exposes an OAuth 2.1 consent and token-issuance flow for its Model Context Protocol (MCP) Server Trigger workflows. When a client requests authorization for a workflow resource, the server issues consent and tokens without confirming that the requesting user owns or has been granted access to the referenced workflow.
An authenticated user with only member-level privileges can register an OAuth client and self-approve consent for a workflow belonging to a different user. The resulting access token is treated as valid by the token-issuance endpoint. The attacker then invokes the target workflow through the MCP interface. Requests execute in the workflow owner's project context, using the owner's stored credentials for any connected integrations.
Root Cause
The OAuth consent handler introduced in 2.27.0 performs authentication of the requesting user but omits an ownership or role check against the workflow specified as the OAuth resource. Consent approval and token issuance rely solely on session authentication rather than on workflow-level access control lists.
Attack Vector
Exploitation requires network access to the n8n instance and a valid member-level account. The attacker registers an OAuth client, initiates the OAuth 2.1 authorization flow targeting a victim workflow ID, approves consent on their own behalf, and exchanges the resulting authorization grant for an access token. The attacker then submits crafted tool inputs to the MCP Server Trigger and reads the outputs, which may contain data pulled from the workflow owner's connected third-party integrations.
No synthetic proof-of-concept code is reproduced here. Refer to the GitHub Security Advisory GHSA-q5xf-xhwf-cwqf and the VulnCheck Advisory for vendor-supplied technical detail.
Detection Methods for CVE-2026-65594
Indicators of Compromise
- OAuth client registrations created by member-level accounts on n8n instances running vulnerable versions.
- Access tokens issued for workflow resource IDs that the requesting user does not own.
- MCP Server Trigger executions whose invoking OAuth subject differs from the workflow owner recorded in the project metadata.
Detection Strategies
- Correlate n8n audit logs for oauth.consent.approved and oauth.token.issued events against workflow ownership records to flag cross-user token issuance.
- Alert on newly registered OAuth clients on internet-exposed n8n instances that lack a corresponding change ticket.
- Monitor for anomalous MCP Server Trigger invocations that touch credentials or integrations not previously accessed by the invoking user.
Monitoring Recommendations
- Ingest n8n application and access logs into a central SIEM or data lake and retain OAuth flow events for at least 90 days.
- Baseline expected MCP Server Trigger callers per workflow and alert on deviations.
- Review outbound network traffic from n8n to integrated SaaS APIs for volumes or destinations that do not match the workflow owner's normal activity.
How to Mitigate CVE-2026-65594
Immediate Actions Required
- Upgrade n8n to 2.29.8 or 2.30.1 or later, which enforce workflow-level authorization during OAuth consent and token issuance.
- Rotate credentials stored in n8n integrations for any workflow that was reachable through the MCP Server Trigger during the exposure window.
- Audit OAuth client registrations and revoke any clients created by non-administrative users pending review.
Patch Information
n8n released fixes in versions 2.29.8 and 2.30.1. The patches add an ownership check that validates the authenticated user's access to the workflow specified as the OAuth resource before consent can be granted and before tokens are issued. See the GitHub Security Advisory GHSA-q5xf-xhwf-cwqf for the vendor advisory and release notes.
Workarounds
- Disable MCP Server Trigger workflows configured with n8n OAuth2 authentication until the instance is patched.
- Restrict n8n instance access to trusted administrators only, removing member-level accounts where feasible.
- Place the n8n instance behind a reverse proxy that enforces additional authentication and blocks OAuth endpoints from untrusted networks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
