8.8

CVE-2026-65015

n8n before 2.30.1 Privilege Escalation via run_node_tool

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
N8n ≫ N8n SwEdition community SwPlatform node.js Version < 2.29.8
N8n ≫ N8n SwEdition enterprise SwPlatform node.js Version < 2.29.8
N8n ≫ N8n Version 2.30.0 SwEdition community SwPlatform node.js
N8n ≫ N8n Version 2.30.0 SwEdition enterprise SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 7.2 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9
Vendor Advisory
Mitigation
https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool
Third Party Advisory
VDB Entry