highCVE-2026-65016Jul 22, 2026

CVE-2026-65016: n8n SSO Instance-Role Provisioning Privilege Escalation to Owner

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

When n8n's Enterprise SSO role provisioning is enabled, an attacker who can control the instance-role claim sent by the Identity Provider can set it to the owner role, gaining full administrative…

Packagen8n
Ecosystemnpm
Affected< 1.123.64
Fixed in1.123.64

The problem

n8n's Enterprise SSO feature can automatically assign a global instance role to a user at login time based on a claim in the IdP's SAML assertion or OIDC token. The claim is named n8n_instance_role.

The provisioning code accepted any role string, including global:owner, without validation. The token-exchange identity path already blocked this assignment, but the SSO provisioning path had no equivalent guard. A user whose IdP delivers n8n_instance_role: global:owner is silently promoted to instance owner on their next login, giving them full control over all workflows, credentials, users, and instance settings.

Proof of concept

A working proof-of-concept for CVE-2026-65016 in n8n, with the exact payload below.

text
<!-- Attacker-controlled SAML assertion attribute -->
<!-- Delivered by a permissive or compromised IdP -->
<saml:Attribute Name="n8n_instance_role">
  <saml:AttributeValue>global:owner</saml:AttributeValue>
</saml:Attribute>

The root cause is CWE-639: Authorization Bypass Through User-Controlled Key. The SSO provisioning handler accepted the n8n_instance_role value from the IdP without a denylist check on privileged roles.

The patch adds an explicit guard that rejects any incoming SSO role claim that resolves to global:owner, mirroring the check already present in the token-exchange path. The fix is a single deny condition: if the resolved role equals global:owner, the provisioning step is skipped and the login proceeds without escalating the user's role.

Exploitability requires (a) Enterprise SSO configured, (b) N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE set to instance_role or instance_and_project_roles (disabled by default), and (c) attacker control over the claim value in the IdP.

The fix

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1. If immediate upgrade is not possible, set N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE=false (or leave it unset, as it is disabled by default) and audit IdP claim mappings to confirm no user-controllable attribute can supply the n8n_instance_role claim value.

Reported by Jubke (n8n security team internal report).

References: [1][2][3][4][5][6]

Related research