The recent security vulnerability in n8n, a workflow automation platform, has raised concerns among users and developers alike. This issue, tracked as CVE-2026-59208, allows attackers to log in as users from another issuer, potentially compromising user accounts and data. The vulnerability stems from a flaw in the token exchange mechanism, which is designed to allow OEM partners to embed the product without requiring a second login. However, this feature, when configured to trust multiple external token issuers, can be exploited by attackers to gain unauthorized access.
The bug lies in the way n8n handles the sub claim in JWT tokens. The sub value is intended to be unique within the context of the issuer, but n8n's implementation only considered the sub value from one issuer, ignoring the iss claim. This oversight allowed attackers to obtain a valid token from one issuer and use it to log in as a user associated with another issuer, all without needing their password. The issue was reported by Strix, an AI penetration testing agent, and the fix was released on June 24, 2026.
The impact of this vulnerability is significant, especially for Enterprise instances configured to trust multiple external token issuers. However, it is important to note that the attack requires the attacker to obtain a valid token, and the advisory does not specify how this token is acquired. The severity of the vulnerability is rated as high (7.6 on CVSS 4.0) by GitHub, indicating a potential for widespread exploitation.
To mitigate this risk, n8n recommends patching the affected versions (2.27.4 and 2.28.0) to the latest stable build (2.30.6). If patching is not feasible, users can temporarily disable the token exchange feature by setting the N8NTOKENEXCHANGETRUSTEDKEYS environment variable and turning off the preview flag. However, these measures are considered short-term solutions, and n8n acknowledges that they do not fully remediate the risk.
This incident highlights the importance of staying vigilant and promptly addressing security vulnerabilities. Users and developers should carefully review the advisory and take appropriate actions to protect their systems and data. As always, it is crucial to keep software up to date and follow best practices for secure system management.
