CVE-2026-59208 – n8n

n8n has released a security update to address CVE-2026-59208, an authentication vulnerability affecting instances configured with multiple trusted token-exchange issuers. The issue allowed external identities to be mapped to local accounts using only the JWT sub claim while ignoring the iss claim. An attacker with a valid token from one trusted issuer and a matching sub value from another issuer could authenticate as the victim. The issue is resolved in n8n versions 2.27.4 and 2.28.1.

The CVSS score is 7.6, which is High severity. Based on the information provided, there is no verified exploitation associated with this vulnerability. Although it is not a remote code execution issue, it can result in privilege escalation through improper authentication handling, making timely patching important for affected deployments.