8.8

CVE-2026-65015

n8n before 2.30.1 Privilege Escalation via run_node_tool

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
N8n ≫ N8n SwEditioncommunity SwPlatformnode.js Version < 2.29.8
N8n ≫ N8n SwEditionenterprise SwPlatformnode.js Version < 2.29.8
N8n ≫ N8n Version2.30.0 SwEditioncommunity SwPlatformnode.js
N8n ≫ N8n Version2.30.0 SwEditionenterprise SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 7.2 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9
Vendor Advisory
Mitigation
https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool
Third Party Advisory
VDB Entry