CVE-2026-65015 in n8n
Summary
by MITRE • 07/22/2026
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within n8n versions prior to 2.30.1 in the AI Agents functionality where insufficient authorization controls permit unauthorized privilege escalation. This flaw specifically affects the node-execution tool component which fails to validate user permissions before executing potentially dangerous operations. The vulnerability stems from inadequate access control mechanisms that should have prevented a Project Viewer role from performing actions beyond their designated privileges. When an attacker with minimal permissions engages with an AI agent configured with node tools, they can trigger execution of arbitrary nodes within the system. This technical weakness enables unauthorized users to access credential secrets and execute operations that should only be available to administrators or users with elevated privileges.
The operational impact of this vulnerability is significant as it allows attackers to bypass the intended security model of n8n's role-based access control system. Project Viewer users typically have read-only permissions and limited execution capabilities, but this flaw enables them to escalate their privileges to gain full administrative access within the context of the AI agent's node execution environment. The vulnerability creates a pathway for lateral movement within the system where attackers can access sensitive data, execute arbitrary code, and potentially compromise other connected systems or services that rely on n8n's automation capabilities.
From a security standards perspective, this vulnerability aligns with CWE-276 which addresses improper privileges and CWE-732 which covers inadequate protection of system resources. The flaw also maps to ATT&CK technique T1078 which covers valid accounts and privilege escalation through unauthorized access to system resources. The root cause demonstrates a failure in implementing proper input validation and authorization checks within the AI agent execution pipeline. This represents a critical oversight in the security architecture where the system assumes that users with access to the AI interface have appropriate permissions for all underlying operations, without implementing necessary authorization boundaries.
Mitigation strategies should include immediate upgrade to n8n version 2.30.1 or later which contains the patched authorization controls for the AI Agents feature. Organizations should also implement additional monitoring of AI agent interactions and node execution patterns to detect anomalous behavior that might indicate privilege escalation attempts. Network segmentation and least-privilege principles should be enforced where possible, ensuring that users with access to AI agents have minimal necessary permissions. Additional defensive measures include implementing automated security scanning of AI agent configurations and regular security assessments of the automation platform's access control mechanisms to prevent similar vulnerabilities from emerging in other components of the system.