Executive brief
n8n is a workflow automation platform that includes an AI Agents feature allowing users to create intelligent agents that can execute tasks. A privilege escalation vulnerability allows read-only Project Viewer users to bypass authorization checks and execute arbitrary nodes with elevated permissions, potentially gaining access to sensitive credentials and executing commands on the server. This affects organizations using shared projects with lower-privileged team members.
Technical details
The vulnerability exists in n8n's AI Agents feature where the node-execution tool lacks proper authorization checks. The agent's run_node_tool endpoint is authorized only by the agent:execute scope and does not verify that the requesting Project Viewer user has permission to execute nodes or access associated credentials. An attacker with Project Viewer role can chat with an agent that has node tools enabled, causing the agent to execute arbitrary nodes using the project's credentials without authorization validation. If command-execution capable nodes (such as Execute Command or SSH) are enabled, this can be extended to remote code execution on the n8n host. Patches are available in versions 2.29.8 and 2.30.1.
Affected products
- n8n n8n < 2.30.1, < 2.29.8
Timeline
- 2026-07-08: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in versions 2.29.8 and 2.30.1