Full research report
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
Executive assessment
CVE-2026-59208 is a well-defined identity-binding error in n8n's Enterprise token exchange feature: the implementation treats JWT sub as globally unique rather than issuer-scoped, contrary to RFC 7519, allowing cross-issuer account impersonation without credential knowledge. The attack surface is deliberately narrow—only Enterprise OEM deployments running a preview feature with multiple issuer configurations are exposed—but within that scope the impact is full account takeover. The companion CVE-2026-54305 is an independent authorisation failure in a different Enterprise feature, patched two weeks earlier; its proximity in the reporting cycle suggests sustained security research attention on n8n's Enterprise tier rather than a coordinated exploit campaign. Both CVEs lack public exploit code as of 16 July 2026, EPSS and CISA data consistently reflect very low exploitation probability, and the patch cadence is fast. Defenders on affected Enterprise versions should treat both patches as standard urgent updates, with the specific caveat that n8n's release changelogs do not document these fixes—security advisory monitoring is the only reliable detection path.
What happened
On 24 June 2026 n8n shipped a silent fix for CVE-2026-59208, a flaw in the Enterprise token exchange feature (an RFC 8693 implementation used by OEM partners) where JWT identity resolution keyed on the sub claim alone and ignored the iss claim. Because RFC 7519 guarantees subject uniqueness only within the minting issuer, two trusted issuers emitting the same sub value would both resolve to a single n8n account, allowing a token from one issuer to authenticate as a user registered under another. The CVE record was not published until 9 July 2026, fifteen days after patching. A companion vulnerability, CVE-2026-54305, was patched around 10 June 2026 in a different Enterprise feature—Dynamic Credentials—where three endpoints lacked ownership and scope authorisation checks, permitting any authenticated user to enumerate, overwrite, or revoke other users' stored OAuth tokens.
Affected scope
CVE-2026-59208: n8n Enterprise instances on versions below 2.27.4 or on exactly 2.28.0, where the token exchange preview feature is active and N8N_TOKEN_EXCHANGE_TRUSTED_KEYS contains keys from two or more distinct issuers. CVE-2026-54305: n8n Enterprise instances below 1.123.55, 2.25.7, or 2.26.2 with Dynamic Credentials enabled. Both issues are Enterprise-only; self-hosted community instances are unaffected.
Technical assessment
CVE-2026-59208 is a violation of the identity-binding requirement in RFC 7519, which defines sub as unique only within the context of its issuer, making (iss, sub) the correct identity key. The token exchange flow correctly verified the incoming JWT's signature against a configured public key but then matched the resulting claims to a local n8n account using sub in isolation. The attack requires the adversary to hold a valid token from a configured trusted issuer; the advisory does not specify whether ordinary users at a trusted issuer can influence which sub value their identity provider assigns, leaving the practical exploitation path partially unclear. CVE-2026-54305 is a distinct authorisation control failure: the Dynamic Credentials endpoints accepted any authenticated n8n session without per-resource ownership checks, exposing credential enumeration and OAuth token hijack to any session holder. Workflows running under a hijacked credential would subsequently execute under the attacker's OAuth identity.
Recommended defensive actions
- Upgrade n8n to 2.27.4 or 2.28.1 (or any later stable release) to remediate CVE-2026-59208; upgrade to 1.123.55, 2.25.7, or 2.26.2 minimum to remediate CVE-2026-54305.
- If immediate patching is not possible for CVE-2026-59208, reduce N8N_TOKEN_EXCHANGE_TRUSTED_KEYS to a single issuer entry or disable the token exchange preview feature entirely.
- For CVE-2026-54305, if patching must wait, disable Dynamic Credentials by unsetting N8N_ENV_FEAT_DYNAMIC_CREDENTIALS and restrict instance access to fully trusted users only.
- Do not rely on n8n release changelogs for security patch awareness: neither the 2.27.4 nor 2.28.1 changelog mentions CVE-2026-59208. Monitor the n8n GitHub security advisories page directly.
- Audit all Enterprise deployments to identify instances running multi-issuer token exchange configurations, as these represent the entire exposure surface for CVE-2026-59208.
Uncertainties and evidence gaps
- How an attacker obtains a valid token from a trusted issuer carrying the specific sub value needed to impersonate a target is unspecified in the advisory; whether an ordinary user at a trusted issuer can control or predict their assigned sub remains publicly unanswered.
- CVSS scoring diverges between sources for both CVEs: NVD rates CVE-2026-54305 at 9.9 CRITICAL (3.1) while GitHub rates it 8.9 HIGH (4.0), and CVE-2026-59208 is 7.6 HIGH (4.0) versus 6.8 MEDIUM (3.1)—the basis for these differences is not explained in any source.
- n8n had not provided a statement to The Hacker News confirming full scope or impact details as of 16 July 2026.
- The number of live Enterprise instances running multi-issuer token exchange configurations is unknown; the feature's preview status suggests limited but non-zero deployment.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation or public proof-of-concept; CISA SSVC assessment dated 13 July 2026 records exploitation status as none for CVE-2026-59208, consistent with an EPSS score of 0.00343 (26th percentile).
Research began with parallel searches for the two stated CVEs and a direct fetch of the source THN article to establish a baseline of claims requiring corroboration. Vendor advisories on GitHub were fetched for both CVEs to obtain authoritative scoring, affected versions, and reporter attribution. NVD records were fetched independently to check for scoring divergence and CISA exploitation status. A targeted search for proof-of-concept code and actor interest found no PoC for CVE-2026-59208, consistent with the low EPSS score and CISA's none exploitation rating. The investigation concludes that both vulnerabilities are credibly documented, patched, and currently unexploited in the wild.
- What are the confirmed details of CVE-2026-59208 and which GitHub advisory covers it?Searched for 'CVE-2026-59208 n8n token exchange vulnerability advisory' and 'n8n CVE-2026-59208 GitHub advisory GHSA token exchange issuer'
Identified GHSA-mq3m-f8x3-579w as the primary advisory; confirmed CVSS 4.0 7.6 HIGH and reporter bearsyankees (Strix). Also found GHSA-2j5h-858j-5mpf for CVE-2026-54305.
why Locating the advisory GHSA ID before fetching provides a ground truth to verify against other sources.
- What does the THN source article actually assert and does it cite primary sources I can verify?Fetched The Hacker News articlethehackernews.com ↗
Confirmed affected versions (below 2.27.4 and 2.28.0; fixed in 2.27.4 and 2.28.1), patch date 24 June 2026, CVE publication date 9 July 2026, CISA exploitation=none as of 13 July 2026, and no public PoC found as of 16 July 2026.
why The article is untrusted source material; fetching it directly confirms its actual claims before using them as leads.
- Does the GitHub advisory GHSA-mq3m-f8x3-579w confirm all CVE-2026-59208 technical parameters?Fetched GitHub security advisory for CVE-2026-59208github.com ↗
Confirmed CVSS:4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N giving 7.6 HIGH; affected versions confirmed; reporter listed as bearsyankees; no PoC referenced.
why GitHub is the CNA for this CVE; this advisory is the highest-authority source for its technical parameters.
- What does NVD record for CVE-2026-59208 and does it confirm CISA exploitation status?Fetched NVD record for CVE-2026-59208nvd.nist.gov ↗
NVD assigns CVSS 3.1 6.8 MEDIUM (versus GitHub 4.0 7.6 HIGH); CWE-287 and CWE-346; CISA exploitation status confirmed none as of 13 July 2026.
why Corroborates absence of active exploitation and surfaces the scoring discrepancy between CVSS versions, which is relevant for defenders triaging urgency.
- What does the GitHub advisory confirm for CVE-2026-54305 and who reported it?Fetched GitHub security advisory GHSA-2j5h-858j-5mpf for CVE-2026-54305github.com ↗
CVE-2026-54305 is a distinct missing-authorisation flaw in Enterprise Dynamic Credentials endpoints; reporters are Solidscripting and Har1sh-k; fixed in 1.123.55, 2.25.7, 2.26.2; CVSS 4.0 8.9 HIGH.
why Confirms the companion vulnerability has a different mechanism and distinct researcher attribution, ruling out a single coordinated disclosure.
- Does an independent registry advisory corroborate CVE-2026-54305 scope?Fetched GitLab npm advisory for CVE-2026-54305advisories.gitlab.com ↗
Confirmed affected versions, fixed versions, CVSS 9.9 CRITICAL (3.1), CWE-200 and CWE-284; description consistent with GitHub advisory.
why Provides an independent corroboration source outside the vendor's own advisory system.
- Is there any public proof-of-concept or threat actor interest in CVE-2026-59208?Searched for 'n8n CVE-2026-59208 proof of concept exploit PoC bearsyankees strix'
No PoC found for CVE-2026-59208; search results surface a PoC for an older unrelated n8n CVE (CVE-2025-68613) only. No actor chatter identified.
why Absence of PoC corroborates CISA exploitation=none and the low EPSS score, supporting a standard-urgency patch recommendation rather than emergency response.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok8 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1647 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok256 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1583 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 7 opened outside the registered collection
Vulnerability & exploitation1
Vendor & gov advisories5
Primary vendor advisory for CVE-2026-59208; CVSS 4.0 7.6 HIGH, CNA is GitHub, no PoC referenced
Primary vendor advisory for CVE-2026-54305; CVSS 4.0 8.9 HIGH, distinct missing-authorisation flaw on Enterprise Dynamic Credentials endpoints
Independent registry advisory corroborating affected and fixed versions for CVE-2026-54305
NVD record: CVSS 3.1 6.8 MEDIUM, CWE-287 and CWE-346; CISA exploitation status none as of 13 July 2026
NVD record: CVSS 3.1 9.9 CRITICAL, CWE-200 and CWE-284; no exploitation noted
Analysis & research2
Source article covering both CVEs; confirms no public PoC found by THN as of 16 July 2026 and notes CISA exploitation=none
Confirms CVE timeline: reserved 2 July 2026, published 9 July 2026, updated 14 July 2026