Authentication Flaw in n8n Workflow Automation Platform
CVE-2026-59208

7.6HIGH

Key Information:

Vendor: N8n-io
Status: N8n
Vendor: CVE Published:; 9 July 2026

Badges

📰 News Worthy

What is CVE-2026-59208?

CVE-2026-59208 is a significant authentication vulnerability affecting the n8n workflow automation platform, an open-source tool designed for automating repetitive tasks and integrating various services and applications. The flaw exists in versions prior to 2.27.4 and from 2.28.0 up until 2.28.1, where instances configured with multiple trusted token-exchange issuers improperly resolved external identities to local accounts. Specifically, the platform only considered the JWT 'sub' claim while disregarding the 'iss' claim. This oversight allows an attacker, who possesses a valid token from one trusted issuer and a 'sub' that corresponds to a victim under a different issuer, to authenticate as that victim. Such a vulnerability can have severe repercussions for organizations, potentially leading to unauthorized access to sensitive data and functionality within automated workflows.

Potential impact of CVE-2026-59208

Unauthorized Access: The vulnerability allows malicious actors to exploit authentication mechanisms, gaining unauthorized access to accounts and systems. This can lead to unauthorized actions performed under a victim's identity, further compromising the integrity of operations within the n8n platform.
Data Compromise: With unauthorized access, attackers could manipulate or exfiltrate sensitive data processed by n8n workflows. This can result in data breaches, exposing confidential information integral to business operations, thereby putting organizations at risk of compliance violations and reputational damage.
Operational Disruption: If exploited, this vulnerability can disrupt automated processes facilitated by n8n, impacting an organization’s workflow efficiency. Such disruptions can hinder productivity and result in cascading failures across integrated services, severely affecting business continuity.