AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution? What should I do?

    When an n8n instance is configured with more than one trusted token-exchange issuer, external identities are resolved to local accounts using only the JWT sub claim, ignoring the issuer (iss).

    Affected: npm/n8n >= 2.28.0, < 2.28.1 and npm/n8n < 2.27.4. Fixed in: 2.28.1. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-59208-n8n (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: npm/n8n >= 2.28.0, < 2.28.1 and npm/n8n < 2.27.4. Fixed in: 2.28.1.

      • Check your version: run npm ls n8n. Versions >= 2.28.0, < 2.28.1 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@2.28.1 (first patched version 2.28.1).
      2. Upgrade to n8n version 2.28.1 or later.
      3. If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer.
      4. Disable the token exchange feature entirely if it is not in active use.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-59208-n8n (opens external site)

      Did this work for you?

    Add your answer or comment