CVE-2026-65015: n8n privilege escalation in AI Agents node-execution tool

Executive brief

A vulnerability in n8n's AI Agents feature allows users with restricted 'Project Viewer' access to bypass security controls and perform actions they are not authorized for. By interacting with an AI agent, a low-privileged user can execute server-side tasks and access sensitive credentials. In some configurations, this could allow an attacker to take full control of the server hosting the n8n application.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in n8n's AI Agents module within the 'run_node_tool' component. The agent's node-execution tool was authorized only by the 'agent:execute' scope and failed to verify if the requesting user had sufficient permissions to execute nodes or access project credentials. An attacker with Project Viewer privileges can exploit this by chatting with an agent that has node tools enabled to execute arbitrary tool nodes. If command-execution nodes like SSH or Execute Command are enabled, this leads to remote code execution (RCE) on the host. The issue is patched in versions 2.29.8 and 2.30.1.

Affected products

• n8n-io n8n < 2.29.8, >= 2.30.0 < 2.30.1

Timeline

• 2026-07-08: disclosed: Initial disclosure by reporter
• 2026-07-22: advisory: GitHub Advisory published

References

• https://api.github.com/users/trap-bytes
• https://github.com/trap-bytes
• https://api.github.com/users/trap-bytes/gists%7B/gist_id%7D
• https://api.github.com/users/trap-bytes/repos
• https://avatars.githubusercontent.com/u/80951137?v=4
• https://api.github.com/users/trap-bytes/events%7B/privacy%7D