AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login? What should I do?

    In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, the service did not check that the trusted key's permitted role ceiling covered that account, nor that the email claim was verified.

    Affected: n8n >= 2.32.0, < 2.32.1 and n8n < 2.31.5. Fixed in: 2.31.5. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/ghsa-8342-988q-86cr-n8n (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: n8n >= 2.32.0, < 2.32.1 and n8n < 2.31.5. Fixed in: 2.31.5.

      • Check your version: run npm ls n8n. Versions >= 2.32.0, < 2.32.1 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@2.32.1 (first patched version 2.32.1).
      2. Disable the embed login feature by setting N8N_TOKEN_EXCHANGE_ENABLED=false.
      3. Restrict network access to the n8n instance to fully trusted parties only, and audit all configured trusted keys and their allowedRoles assignments.
      4. Review auth_identity records for unexpected token-exchange entries linked to high-privilege accounts.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/ghsa-8342-988q-86cr-n8n (opens external site)

      Did this work for you?

    Add your answer or comment