Am I affected by n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner? What should I do?
n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider (IdP) to an n8n global role and applies it during authentication.
Affected: n8n < 1.123.64, 2.0.0-rc.0 to 2.29.8, 2.30.0 to 2.30.1. Fixed in: 1.123.64, 2.29.8, and 2.30.1. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-65016-n8n (opens external site)
1 answer
Am I affected? Affected: n8n < 1.123.64, 2.0.0-rc.0 to 2.29.8, 2.30.0 to 2.30.1. Fixed in: 1.123.64, 2.29.8, and 2.30.1.
- Check your version: run
npm ls n8n. Versions < 1.123.64 of n8n are affected.
What to do now
- Upgrade to the fixed version: run
npm install n8n@1.123.64(first patched version 1.123.64). - Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1 or later.
- Disable instance-role provisioning by unsetting or setting
N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE=false. - Audit IdP claim mappings to ensure no user-controllable attribute can supply the instance-role claim value.
- Restrict SSO access to fully trusted users only.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-35q8-9mj6-wjmf (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-65016-n8n (opens external site)
Did this work for you?- Check your version: run