n8n npm Package Privilege Escalation Issue Under Investigation
An issue has been reported in the n8n npm package where SSO-authenticated users may be able to gain full administrative control under specific conditions. Users of affected versions should assess their exposure.
What happened
An early warning has been issued regarding a potential privilege escalation vulnerability in the n8n npm package. Reportedly, the Enterprise SSO instance-role provisioning feature appears to allow an SSO-authenticated user to be provisioned as an instance owner, potentially granting them full administrative control. This issue is said to be exploitable when Enterprise SSO is enabled and instance-role provisioning is configured. The affected versions are n8n (npm) <1.123.64, <2.29.8, <2.30.1. It is recommended to upgrade to n8n version 1.123.64, 2.29.8, or 2.30.1 to remediate the vulnerability. The incident is under investigation, and primary sources should be consulted for the most current information.
How 0Day mitigates this
n8n is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.