n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

🗓️ 22 Jul 2026 22:31:01Reported by GitHub Advisory DatabaseType

Member-level users can run other users' server trigger workflows due to missing authorization; fixed in versions 2.29.8 and 2.30.1.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-65594	22 Jul 202611:21	–	attackerkb
CVE	CVE-2026-65594	22 Jul 202611:21	–	cve
Cvelist	CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check	22 Jul 202611:21	–	cvelist
EUVD	EUVD-2026-47638	22 Jul 202611:21	–	euvd
Github Security Blog	Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check	22 Jul 202612:32	–	github
NVD	CVE-2026-65594	22 Jul 202612:18	–	nvd
OSV	CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check	22 Jul 202611:21	–	osv
OSV	GHSA-5VFW-JC4P-FJ39 Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check	22 Jul 202612:32	–	osv
OSV	GHSA-Q5XF-XHWF-CWQF n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check	22 Jul 202622:31	–	osv
Patchstack	NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check	22 Jul 202622:31	–	patchstack

Vulners

Node

n8n n8nRange<2.29.8npm

n8n n8nRange2.30.0–2.30.1npm

Source	Link
github	www.github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-65594
github	www.github.com/n8n-io/n8n/releases/tag/[email protected]
github	www.github.com/n8n-io/n8n/releases/tag/[email protected]
vulncheck	www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check
github	www.github.com/advisories/GHSA-q5xf-xhwf-cwqf

22 Jul 2026 22:31Current

5.3Medium risk

Vulners AI Score5.3

CVSS 45.1