highCVE-2026-65015Jul 22, 2026

CVE-2026-65015: n8n AI Agent Project Viewer Privilege Escalation via run_node_tool

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A read-only Project Viewer in n8n can chat with an AI agent to silently execute arbitrary tool nodes and access credential secrets they are not permitted to see, bypassing role-based access controls…

Packagen8n
Ecosystemnpm
Affected>= 2.30.0, < 2.30.1
Fixed in2.30.1

The problem

In n8n's AI Agents feature (versions 2.30.0 and earlier), the endpoint that handles tool-node execution during an agent chat session checks only the broad agent:execute scope. It does not verify that the calling user holds workflow:execute permission or any credential-access right.

This means a Project Viewer, whose role is explicitly read-only, can trigger full server-side node execution by simply chatting with an agent that has node tools configured. The agent runs those tools using the project's decrypted credentials, which the viewer was never meant to access.

On instances with Execute Command or SSH nodes enabled, this becomes arbitrary OS command execution on the n8n host.

Proof of concept

A working proof-of-concept for CVE-2026-65015 in n8n, with the exact payload below.

http
POST /rest/agents/<agent-id>/chat HTTP/1.1
Host: <n8n-host>
Cookie: <project-viewer-session-cookie>
Content-Type: application/json

{
  "message": "Please run the Execute Command tool and return the output of: id"
}

The root cause is CWE-863 (Incorrect Authorization). The agent chat handler invokes run_node_tool after a single scope check (agent:execute) that every project member, including viewers, satisfies. No secondary check on workflow:execute or per-credential access is performed before the node is actually run server-side with the project's stored credentials.

The fix in 2.30.1 (and backport 2.29.8) adds an explicit permission gate inside the tool-execution path, verifying that the requesting user holds both workflow execution rights and credential-read rights before any node is dispatched. Public PoC not yet published; payload derived from advisory description and the missing authorization gate described in the patch.

The fix

Upgrade to n8n 2.30.1 or 2.29.8. If immediate upgrade is not possible: (1) remove agents from N8N_ENABLED_MODULES to disable the AI Agents module entirely, (2) restrict project membership to fully trusted users and remove Project Viewer access from untrusted accounts on agent-enabled projects, or (3) disable command-execution nodes such as Execute Command and SSH.

These mitigations reduce impact but do not fully remediate the flaw.

Reported by Jubke (n8n security team).

References: [1][2][3][4][5][6]

Related research