CVE-2026-65015
n8n before 2.30.1 Privilege Escalation via run_node_tool
CVE-2026-65015 is a high vulnerability (CVSS 7.2) in N8n, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in n8n 2.30.1.
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
n8n before 2.30.1 Privilege Escalation via run_node_tool
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
CVE-2026-65015- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-47631
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
EUVD-2026-47631- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w46p-w7w2-fr9g
Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references.
Original Description
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
GHSA-w46p-w7w2-fr9g- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x5vx-c2c8-m3w9
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
Impact
In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.
As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.
Users of the AI Agents feature who share team projects with lower-privileged members are affected.
Patches
The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Disable the AI Agents module by removing
agentsfrom theN8N_ENABLED_MODULESenvironment variable. - Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.
- Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-x5vx-c2c8-m3w9- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
CVE-2026-65015- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
n8n before 2.30.1 Privilege Escalation via run_node_tool
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
CVE-2026-65015- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-w46p-w7w2-fr9g
Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references.
Original Description
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
- Record
GHSA-w46p-w7w2-fr9g- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-x5vx-c2c8-m3w9
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
Impact
In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.
As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.
Users of the AI Agents feature who share team projects with lower-privileged members are affected.
Patches
The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Disable the AI Agents module by removing
agentsfrom theN8N_ENABLED_MODULESenvironment variable. - Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.
- Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- Record
GHSA-x5vx-c2c8-m3w9- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-65015 No score
CVE-2026-65015 in n8n - Patched by Root
Root has patched CVE-2026-65015 in the n8n package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-65015- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
n8nnpm |
2.30.0 up to 2.30.1 | 2.30.1 |
n8nnpm |
before 2.29.8 | 2.29.8 |
n8nRoot:npm |
before 2.19.3-aikido.15 | 2.19.3-aikido.15 |
@rootio/n8nRoot:npm |
before 2.19.3-root.io.15 | 2.19.3-root.io.15 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-02 | affected, aliases | |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9
vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool
nvd.nist.gov/vuln/detail/CVE-2026-65015