{"id":"CVE-2026-65015","aliases":["EUVD-2026-47631","GHSA-w46p-w7w2-fr9g","GHSA-x5vx-c2c8-m3w9","ROOT-APP-NPM-CVE-2026-65015"],"status":"published","title":"n8n before 2.30.1 Privilege Escalation via run_node_tool","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00608,"percentile":0.49589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-07-22T11:21:38Z","modified":"2026-10-31T02:30:28Z","fixes":[{"ecosystem":"npm","package":"n8n","fixed_in":["2.30.1","2.29.8"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"n8n","fixed_in":["2.19.3-aikido.15"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/n8n","fixed_in":["2.19.3-root.io.15"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"n8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.0"},{"fixed":"2.30.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"n8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.8"}]}]},{"source":"osv","ecosystem":"npm","package":"n8n","ranges":[{"type":"SEMVER","events":[{"introduced":"2.30.0"},{"fixed":"2.30.1"}]}]},{"source":"osv","ecosystem":"npm","package":"n8n","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.29.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"n8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-aikido.15"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/n8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-root.io.15"}]}]}],"products":[{"vendor":"n8n","product":"n8n"},{"vendor":"n8n-io","product":"n8n"}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65015","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w46p-w7w2-fr9g"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8","tags":["web"]},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x5vx-c2c8-m3w9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65015.json","tags":["advisory"]},{"url":"https://github.com/n8n-io/n8n","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-65015","title":"n8n before 2.30.1 Privilege Escalation via run_node_tool","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"published","published":"2026-07-22T11:21:38.034Z","modified":"2026-10-29T21:16:19.932Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-47631","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"published","published":"2026-07-22T11:21:38Z","modified":"2026-10-29T21:16:19Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T16:59:14.250155Z"}],"ghsa":[{"id":"GHSA-w46p-w7w2-fr9g","title":"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references.\n\n## Original Description\nn8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"withdrawn","published":"2026-07-22T12:32:17Z","modified":"2026-07-22T17:54:32Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:50.444681Z"},{"id":"GHSA-x5vx-c2c8-m3w9","title":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","description":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by removing `agents` from the `N8N_ENABLED_MODULES` environment variable.\n- Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.\n- Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","status":"published","published":"2026-07-22T17:55:55Z","modified":"2026-07-22T17:55:56Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-65015","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"published","published":"2026-07-22T12:18:18.587Z","modified":"2026-10-29T19:17:25.6Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:32.089897Z"}],"osv":[{"id":"CVE-2026-65015","title":"n8n before 2.30.1 Privilege Escalation via run_node_tool","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"published","published":"2026-07-22T11:21:38.034Z","modified":"2026-10-31T02:30:28.647815203Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"GHSA-w46p-w7w2-fr9g","title":"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references.\n\n## Original Description\nn8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","status":"withdrawn","published":"2026-07-22T12:32:17Z","modified":"2026-07-22T18:01:07.070903084Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"GHSA-x5vx-c2c8-m3w9","title":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","description":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by removing `agents` from the `N8N_ENABLED_MODULES` environment variable.\n- Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.\n- Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","status":"published","published":"2026-07-22T17:55:55Z","modified":"2026-07-22T18:11:51.80415Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"ROOT-APP-NPM-CVE-2026-65015","title":"CVE-2026-65015 in n8n - Patched by Root","description":"Root has patched CVE-2026-65015 in the n8n package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T03:42:47Z","modified":"2026-10-06T04:15:05.113477277Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}