Privilege Escalation Vulnerability in n8n: SSO Instance-Role Provisioning
Summary
GHSA-mwq7-vcmc-cm4q: Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It features a user-friendly interface and supports a wide range of integrations. However, certain versions of n8n are vulnerable to a privilege escalation issue related to Enterprise SSO instance-role provisioning, which can lead to unauthorized access and control over workflows and configurations.
Vulnerability Detail
The vulnerability exists in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1, where the Enterprise SSO instance-role provisioning does not adequately restrict the assignment of the global:owner role. This flaw allows an SSO-authenticated user, whose instance-role claim resolves to global:owner, to be provisioned as the instance owner. Consequently, the user gains full administrative control over workflows, credentials, users, and instance configurations. Exploitation of this vulnerability requires the Enterprise SSO to be configured and the instance-role provisioning to be enabled, which is not the default setting. Attackers can exploit this by controlling the instance-role claim value issued by the Identity Provider (IdP).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if you cannot update immediately, consider disabling the instance-role provisioning feature by setting the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE environment variable to false. This will prevent the assignment of roles until you can apply the necessary updates.
Conclusion
The privilege escalation vulnerability in n8n's Enterprise SSO instance-role provisioning poses significant risks to users by allowing unauthorized access to administrative controls. It is crucial to update to the latest patched versions to mitigate these risks and ensure the security of your workflows and configurations.
See every vulnerability recorded for n8n →
FAQ
The vulnerability allows unauthorized users to gain administrative access through improper role provisioning in Enterprise SSO.
Versions of n8n prior to 1.123.64, 2.29.8, and 2.30.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, disable the instance-role provisioning feature by setting the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE environment variable to false.
If exploited, this vulnerability can lead to unauthorized administrative access, allowing attackers to manipulate workflows, credentials, and user settings.
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
