CVE-2026-65015 PUBLISHED

n8n before 2.30.1 Privilege Escalation via run_node_tool

Assigner: VulnCheck
Reserved: 21.07.2026 Published: 22.07.2026 Updated: 22.07.2026

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
CVSS Score: 7.2

Product Status

Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.30.1 (excl.)
  • Version 2.30.1 is unaffected
Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.29.8 (excl.)
  • Version 2.29.8 is unaffected

Credits

  • trap-bytes reporter

References

Problem Types

  • Incorrect Authorization CWE