highJul 22, 2026

CVE-2026-65016: n8n SSO Instance-Role Provisioning Privilege Escalation to Instance Owner

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

When Enterprise SSO role provisioning is enabled, an attacker who controls their IdP's role claim can set it to 'global:owner' and be silently promoted to full instance administrator on login.

Packagen8n
Ecosystemnpm
Affected< 1.123.64

The problem

n8n's Enterprise SSO feature can automatically assign a user's global instance role from a claim in the IdP's SAML or OIDC response. The provisioning code path accepted the value 'global:owner' without restriction, meaning any IdP-side user whose claim resolved to that value was provisioned as the instance owner on their next login.

The token-exchange identity path already blocked 'global:owner' assignment, but the instance-role provisioning path had no equivalent guard. An attacker with control over the IdP (or their own IdP attributes) could exploit this to gain full administrative control over all workflows, credentials, users, and instance configuration.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

text
<!-- Malicious SAML assertion attribute: set n8n_instance_role to global:owner -->
<samlp:Response ...>
  <saml:Assertion ...>
    <saml:AttributeStatement>
      <saml:Attribute Name="n8n_instance_role">
        <saml:AttributeValue>global:owner</saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key). The provisioning path trusted the IdP-supplied role claim value and wrote it to the user record without validating it against a denylist of protected roles. Because 'global:owner' is a valid role string in n8n's role model, it was accepted and applied.

The fix mirrors the existing guard in the token-exchange path: the provisioning handler now explicitly rejects any claim value that resolves to 'global:owner', preventing IdP-controlled escalation to instance owner. Feature flag 'N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE' must be set to 'instance_role' or 'instance_and_project_roles' for the instance to be vulnerable, so the default (disabled) configuration is not affected.

The fix

Upgrade to n8n 1.123.64 (1.x branch) or 2.29.8 / 2.30.1 (2.x branches). No configuration workaround fully mitigates the risk; if upgrading is not immediately possible, set N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE=disabled to turn off instance-role provisioning entirely until the patch is applied.

Reported by Jubke (n8n security team).

References: [1][2][3][4]

Related research