CVE-2026-59208Disclosure(n8n / n8n)

MEDIUMCVSS 6.8 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch n8n n8n systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

n8n CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w

Other references

Weakness type (CWE)

CWE-287CWE-346

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
13 mentions across 7 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 12 signals
Disclosure: 7 classified signals
General: 3 classified signals
Peaked 6d ago at 3 mentions (2026-07-15); latest day: 1
13 total mentions across 7 days

Affected systems

Vendors

n8n

Products

n8n

1 version affected across 1 product

Deep dive

Activity timeline13 mentions / 7d

Signal classification4 categories

Disclosure

753.8%

General

323.1%

Patch

215.4%

Active Exploitation

17.7%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	3	Disclosure1General2
2026-07-16	3	Active Exploitation1General1Patch1
2026-07-17	3	Disclosure3
2026-07-18	1	Disclosure1
2026-07-20	1	Disclosure1
2026-08-21	1	Disclosure1
2026-08-26	1	Patch1

Full discourse13 posts

elhacker.NET@elhackernet90d
Disclosure
Fallo en el intercambio de tokens de n8n podría permitir que atacantes accedan como usuarios de otros emisores Se detectó una vulnerabilidad crítica (CVE-2026-59208) en la plataforma n8n que permitía la suplantación de identidad en cuentas Enterprise. El fallo ocurría al validar tokens JWT de múltiples emisores, ignorando el emisor y basándose solo en el identificador del usuario https://blog.elhacker.net/2026/07/fallo-en-el-intercambio-de-tokens-de.html
Post summary
The article reports a critical identity‑spoofing flaw in n8n’s JWT token validation that could affect Enterprise accounts, with no mention of a PoC, exploit tool, active exploitation, or patch.
117055165.4K
141.7K followersView on X
Strix@strix_ai91d
Disclosure
Strix found a high-severity account takeover vulnerability in n8n, now tracked as CVE-2026-59208. The flaw allowed identities from different trusted issuers to be mapped to the same local account. Read the full technical breakdown below ↓ https://t.co/iWALUCdFSL
Post summary
Strix discovered a high‑severity account takeover flaw in n8n (CVE‑2026‑59208) that lets identities from separate trusted issuers map to the same local account, with a detailed technical breakdown linked.
2201341.2K
918 followersView on X
SOCRadar®@socradar90d
Disclosure
Right key, wrong user. 🔑🚪 CVE-2026-59208 in n8n Enterprise exposes a cross-issuer impersonation flaw. If your multi-issuer token exchange is misconfigured, a valid token can map to the wrong identity—exposing workflows and credentials. Identity binding matters just as much as signature validation. Check your configs to mitigate the risk and strengthen your posture. 🔍 Read more: https://hubs.la/Q04pRMVS0 #CyberSecurity #n8n #IdentitySecurity #Automation
Post summary
CVE-2026-59208 is disclosed as a cross‑issuer impersonation flaw in n8n Enterprise, where misconfigured multi‑issuer token exchange can map a valid token to the wrong identity. Administrators are advised to review and strengthen their authentication configurations to mitigate the risk.
10010373
6.4K followersView on X
Arsénio@ArsenioMuanda54d
Disclosure
A falha CVE-2026-59208 no @n8n_io (High) mostra um perigo subtil em JWTs: validar o emissor ('iss') na verificação, mas descartá-lo ao resolver a conta local pelo 'sub'. Se 2 emissores gerarem o mesmo sub, um assume a conta do outro. Correcção: sha256(iss)::sub.
Post summary
The post discloses CVE‑2026‑59208 in n8n, explaining how mismatched JWT issuers can lead to account takeover and provides a hashing-based fix.
1000024
151 followersView on X
CyberTLDR@CyberTLDR89d
Disclosure
1/3: n8n just handed out the wrong accounts at login. A token exchange flaw (CVE-2026-59208) let a valid token from one SSO issuer log you in as someone else entirely. Enterprise instances affected. Takeover by design. #CyberSecurity #InfoSec #CVE #Musk
Post summary
This note announces an n8n SSO token exchange vulnerability (CVE‑2026‑59208) that permits account takeover, but provides no PoC, exploit code, or patch information.
1000055
31 followersView on X
SempreUpdate@SempreUpdate90d
General
Falha de segurança no n8n expõe contas Enterprise https://sempreupdate.com.br/falha-de-seguranca-no-n8n-cve-2026-59208/
Post summary
The post notes a security flaw in n8n (CVE‑2026‑59208) that can expose Enterprise accounts, but it provides no additional context, technical details, or evidence of exploitation.
0001073
4.7K followersView on X
tpx Security ⠠⠵@tpx_Security90d
Patch
Una vulnerabilidad en la plataforma de automatización n8n (CVE-2026-59208) permite a atacantes iniciar sesión como usuarios de otro emisor sin requerir contraseña. El fallo afecta a instancias Enterprise configuradas para confiar en múltiples emisores externos, ya que el sistema valida el reclamo "sub" del token JWT pero ignora el "iss" (emisor). El error, descubierto por un agente de pentesting de IA, fue parcheado en las versiones 2.27.4 y 2.28.1, aunque la corrección fue omitida de los registros de cambios oficiales.
Post summary
A CVE‑2026‑59208 flaw in n8n allows attackers to log in as users of another issuer via JWT claim manipulation, but the issue has been patched in versions 2.27.4 and 2.28.1.
00010205
3.8K followersView on X
Hacker News 20@betterhn2091d
General
CVE-2026-59208: Cross-Issuer Account Takeover in n8n https://www.strix.ai/blog/n8n-cross-issuer-account-takeover (https://news.ycombinator.com/item?id=48921422)
Post summary
The content references CVE‑2026‑59208 and links to a blog about a cross‑issuer account takeover in n8n, but lacks explicit statements on exploitation, mitigation, or proof‑of‑concept details.
10000130
3.0K followersView on X
IntegSec@integ_sec49d
Patch
CVE-2026-59208: n8n Cross-Issuer Token Exchange Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04vrkzK0
Post summary
The text announces CVE‑2026‑59208, a cross‑issuer token exchange authentication bypass in n8n, and focuses on patching and mitigation guidance rather than offering proof‑of‑concepts or active exploitation details.
0000038
33 followersView on X
陽向｜中小企業の「人手不足×サイバーリスク」をn8nで解決する自動化エンジニア@n8nFlowMaster86d
Disclosure
「宛先が合ってれば本人」- n8n Enterpriseの新機能に潜んでいた思い込みです。 CVE-2026-59208(CVSS7.6)。複数の認証基盤を信頼する設定で、発行元(iss)を見ずに宛先(sub)だけで本人確認していました。対象はEnterprise限定機能。セルフホストの大半は影響外です。確認すべき3つ: ①信頼してる認証基盤の数 ②本人確認は宛先だけで済ませてないか ③発行元まで見る設計か
Post summary
The entry discloses a flaw (CVE‑2026‑59208, CVSS 7.6) in n8n Enterprise that permits impersonation by trusting only the subject claim in multi‑auth configurations, affecting only Enterprise deployments and not most self‑hosted instances.
0000045
23 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker88d
Disclosure
CVE-2026-59208 n8n バージョン2.27.4以前および2.28.0から2.28.1以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/07/17/cve-2026-59208-n8n-227422802281/ #IT #Security #cybersecurity
Post summary
The article offers a comprehensive explanation of CVE‑2026‑59208 for specific n8n versions, covering its impact scope and suggested mitigations, but it does not provide a PoC, exploit code, or evidence of active exploitation.
0000058
208 followersView on X
Aviatrix Threat Research Center@aviatrixtrc90d
Active Exploitation
TRC analysis shows attackers exploited CVE-2026-59208 to bypass n8n authentication by manipulating JWT token claims across multiple issuers. Once inside, they disabled SSO enforcement and created local credentials for persistent access. Runtime segmentation helps contain such identity-based breach chains. #IdentitySecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/n8n-token-exchange-flaw-cve-2026-59208
Post summary
The report details real-world exploitation of CVE-2026-59208, where attackers manipulated JWT claims to bypass authentication and establish persistent local credentials.
0000054
1.9K followersView on X
JTCrawford@JtCrawford91d
General
CVE-2026-59208: n8n workflow automation flaw allows cross-issuer account takeover. OAuth trust boundaries matter—sloppy implementation turns SSO convenience into lateral movement vector. Authentication isn't plug-and-play. #CyberSec #AppSec #ZeroTrust
Post summary
The tweet announces CVE-2026-59208 as an n8n automation flaw enabling cross‑issuer account takeover through OAuth misimplementation, without mentioning PoCs, exploits, patches, or active exploitation.
0000047
68 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	n8n	n8n	-	node.js	-
App	n8n	n8n	2.28.0	node.js	-

Explore more

Back to dashboard n8n CVEs n8n vulnerabilities

What researchers are saying

CVE-2026-59208

Strix[verified]@strix_aiDisclosure

Strix discovered a high‑severity account takeover flaw in n8n (CVE‑2026‑59208) that lets identities from separate trusted issuers map to the same local account, with a detailed technical breakdown linked.

SOCRadar®[verified]@socradarDisclosure

CVE-2026-59208 is disclosed as a cross‑issuer impersonation flaw in n8n Enterprise, where misconfigured multi‑issuer token exchange can map a valid token to the wrong identity. Administrators are advised to review and strengthen their authentication configurations to mitigate the risk.

tpx Security ⠠⠵[verified]@tpx_SecurityPatch

A CVE‑2026‑59208 flaw in n8n allows attackers to log in as users of another issuer via JWT claim manipulation, but the issue has been patched in versions 2.27.4 and 2.28.1.

IntegSec[verified]@integ_secPatch

The text announces CVE‑2026‑59208, a cross‑issuer token exchange authentication bypass in n8n, and focuses on patching and mitigation guidance rather than offering proof‑of‑concepts or active exploitation details.

陽向｜中小企業の「人手不足×サイバーリスク」をn8nで解決する自動化エンジニア[verified]@n8nFlowMasterDisclosure

The entry discloses a flaw (CVE‑2026‑59208, CVSS 7.6) in n8n Enterprise that permits impersonation by trusting only the subject claim in multi‑auth configurations, affecting only Enterprise deployments and not most self‑hosted instances.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The report details real-world exploitation of CVE-2026-59208, where attackers manipulated JWT claims to bypass authentication and establish persistent local credentials.

JTCrawford[verified]@JtCrawfordGeneral

The tweet announces CVE-2026-59208 as an n8n automation flaw enabling cross‑issuer account takeover through OAuth misimplementation, without mentioning PoCs, exploits, patches, or active exploitation.

elhacker.NET@elhackernetDisclosure

The article reports a critical identity‑spoofing flaw in n8n’s JWT token validation that could affect Enterprise accounts, with no mention of a PoC, exploit tool, active exploitation, or patch.