Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability allows an attacker to gain instance owner privileges in n8n through a specially crafted SSO authentication flow. This is possible when Enterprise SSO is enabled with instance-role provisioning (N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE flag) and the attacker can control the role claim sent by the Identity Provider (IdP).
The root cause of the vulnerability lies in the IdentityResolutionService, specifically within the resolveRoleForNewUser and resolveRoleForExistingUser methods. These methods are responsible for processing the role claim from the IdP and assigning it to the user in n8n.
Before the patch, these methods lacked a crucial security check to prevent the assignment of the highly privileged global:owner role. The patch, identified in commits 5f5bf285462ad06c0aeabd5651b532e25214b5b1 and its backports, introduces explicit checks to block any attempt to assign the global:owner role during the SSO provisioning process. The vulnerable functions are the ones that were modified to add these checks, as they were the ones that improperly processed the malicious input (the global:owner role claim).
IdentityResolutionService.resolveRoleForNewUserpackages/cli/src/modules/token-exchange/services/identity-resolution.service.ts
IdentityResolutionService.resolveRoleForExistingUserpackages/cli/src/modules/token-exchange/services/identity-resolution.service.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n | npm | < 1.123.64 | 1.123.64 |
| n8n | npm | >= 2.30.0, < 2.30.1 | 2.30.1 |
| n8n | npm | >= 2.0.0-rc.0, < 2.29.8 | 2.29.8 |