{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/jwt-exploitation/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-65595"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["n8n \u003e= 2.30.0, \u003c 2.30.1","n8n \u003c 2.29.8"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","code-execution","vulnerability","jwt-exploitation"],"_cs_type":"advisory","_cs_vendors":["n8n GmbH"],"content_html":"\u003cp\u003eA high-severity vulnerability, identified as CVE-2026-65595, has been discovered in n8n versions prior to 2.30.1 and 2.29.8. This flaw resides within the Token Exchange module, where JSON Web Tokens (JWTs) issued via this mechanism are erroneously assigned all Public API key scopes, irrespective of the authenticating user's actual permissions. This critical misconfiguration allows a low-privileged attacker, who successfully obtains a valid external JWT trusted by a configured issuer, to exchange it for an overly permissive n8n access token. With this escalated token, the attacker can then invoke administrator-only Public API operations, potentially leading to full privilege escalation within the n8n instance and even arbitrary code execution if the Community Packages feature is enabled. The issue impacts n8n instances with both Token Exchange (\u003ccode\u003eN8N_TOKEN_EXCHANGE_ENABLED=true\u003c/code\u003e) and the Public API enabled.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, initially possessing low privileges, obtains a valid external JWT that is trusted by a configured issuer within the target n8n instance.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a request to the n8n instance's Token Exchange module, presenting the valid external JWT for exchange.\u003c/li\u003e\n\u003cli\u003eThe n8n system processes the token exchange, and due to CVE-2026-65595, mistakenly assigns all available Public API key scopes to the newly issued internal access token.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the over-privileged internal JWT, which now grants them full administrative access to the Public API, bypassing their original low-privileged role.\u003c/li\u003e\n\u003cli\u003eUsing this compromised token, the attacker performs administrator-only Public API operations, such as escalating roles for existing users, creating new administrative user accounts, or deleting users.\u003c/li\u003e\n\u003cli\u003eIf n8n's Community Packages feature is enabled (\u003ccode\u003eN8N_COMMUNITY_PACKAGES_ENABLED=true\u003c/code\u003e and \u003ccode\u003eN8N_UNVERIFIED_PACKAGES_ENABLED=true\u003c/code\u003e), the attacker can leverage their administrative privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker installs and executes unverified or malicious packages through the Public API.\u003c/li\u003e\n\u003cli\u003eThis leads to arbitrary code execution on the underlying server hosting the n8n instance, achieving full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows a low-privileged user to achieve full privilege escalation within an affected n8n instance, gaining administrative control. If successful, an attacker can perform actions typically reserved for administrators, including altering user roles, creating new administrative accounts, or deleting existing users. In scenarios where the instance also has the Community Packages feature enabled, this can further lead to remote code execution, granting the attacker arbitrary control over the host system. While the number of specific victims is not public, any organization using affected n8n versions with the Token Exchange and Public API features enabled is at risk. Role escalation impact is greater for instances with an Advanced Permissions license.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-65595 immediately:\u003c/strong\u003e Upgrade all n8n instances to version 2.30.1, 2.29.8, or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDisable Token Exchange as a workaround:\u003c/strong\u003e If immediate patching is not possible, disable the Token Exchange feature by setting \u003ccode\u003eN8N_TOKEN_EXCHANGE_ENABLED=false\u003c/code\u003e or \u003ccode\u003eN8N_ENV_FEAT_TOKEN_EXCHANGE=false\u003c/code\u003e in your n8n environment configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRestrict Public API access:\u003c/strong\u003e As a temporary mitigation, restrict Public API access at the network level to only trusted clients.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDisable unverified Community Package installation:\u003c/strong\u003e To eliminate the code execution path, set \u003ccode\u003eN8N_UNVERIFIED_PACKAGES_ENABLED=false\u003c/code\u003e in your n8n environment configuration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T22:02:39Z","date_published":"2026-07-22T22:02:39Z","id":"https://feed.craftedsignal.io/briefs/2026-07-n8n-privilege-escalation/","summary":"A critical vulnerability, CVE-2026-65595, in n8n's Token Exchange module allows low-privileged users to achieve privilege escalation and potential code execution by exploiting incorrect Public API key scope assignments to JWTs, enabling administrative operations.","title":"n8n Privilege Escalation and Code Execution via Flawed JWT Scope Assignment (CVE-2026-65595)","url":"https://feed.craftedsignal.io/briefs/2026-07-n8n-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Jwt-Exploitation","version":"https://jsonfeed.org/version/1.1"}