p PatchFirst

CVE-2026-65015

CVE-2026-65015 · n8n before 2.30.1 Privilege Escalation via run_node_tool

This page contains facts from public vulnerability sources. Check the original advisory before updating.

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

CVSS 7.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • n8n

    Versions
    • ≥ 0, < 2.30.1: Affected (semver)
    • 2.30.1: Not affected (semver)

    Update to 2.30.1

  • n8n

    Versions
    • ≥ 0, < 2.29.8: Affected (semver)
    • 2.29.8: Not affected (semver)

    Update to 2.29.8

  • n8n npm

    Affected ranges
    • SEMVER: ≥ 2.30.0, < 2.30.1

    Update to 2.30.1

  • n8n npm

    Affected ranges
    • SEMVER: < 2.29.8

    Update to 2.29.8

Original sources

Check your server →