CVE-2026-65015

EUVD-2026-47631
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.01%
Affected Products (NVD)
VendorProductVersion
n8nn8n
𝑥
< 2.29.8
n8nn8n
𝑥
< 2.29.8
n8nn8n
2.30.0
n8nn8n
2.30.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9
https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool