n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
HighCVE-2026-65015 · Published Jul 22, 2026
## Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials. As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host. Users of the AI Agents feature who share team projects with lower-privileged members are affected. ## Patches The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable the AI Agents module by ...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 2.30.0, < 2.30.1 | 2.30.1 |
| < 2.29.8 | 2.29.8 |
Details and references
## Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials. As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host. Users of the AI Agents feature who share team projects with lower-privileged members are affected. ## Patches The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable the AI Agents module by removing `agents` from the `N8N_ENABLED_MODULES` environment variable. - Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled. - Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-65015
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation MediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: SQL injectionMediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: Cross-Tenant Module-Cache Poisoning in the JS Task RunnerMediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution DataMediumJul 22 | Medium | 1.123.64+2 more |
| Jul 22 | n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test WebhookMediumJul 22 | Medium | 2.27.4 |
| Jul 22 | n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" RestrictionMediumJul 22 | Medium | 1.123.64+2 more |