CVE-2026-65015: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

The agent's node-execution tool, run_node_tool, was authorized by the agent:execute scope alone. It ran nodes using the project's credentials and never checked whether the requesting user was allowed to execute nodes or use those credentials. A Project Viewer is meant to be read-only, but could still chat with an agent and have it run tool nodes.

The attacker is therefore an insider or any account added to a team project as a viewer. They get to run arbitrary tool nodes on the server and use credential secrets they could not read. A node such as HTTP Request, with a stored credential, can act on connected services under the project's identity.

The advisory adds a worse case. If a command- or file-capable tool node, such as Execute Command or SSH, is enabled, the escalation extends to arbitrary command execution on the n8n host. Those nodes are disabled by default in recent versions, which limits that path to instances that re-enabled them.

The advisory says users of the AI Agents feature who share team projects with lower-privileged members are affected. The attack needs the module enabled and an agent with node tools on.

The n8n npm package before 2.29.8, and 2.30.0 before 2.30.1, on instances where the AI Agents module is enabled and a project has an agent with node tools enabled and at least one Project Viewer.

npm ls n8n

For Docker, check the image tag. Check whether agents is in N8N_ENABLED_MODULES.

Upgrade to n8n 2.29.8 or 2.30.1, or later.

npm install [email protected]

Temporary mitigations from the advisory, which do not fully fix the risk:

• Remove agents from N8N_ENABLED_MODULES to disable the module.
• Limit project membership to trusted users, and do not give Project Viewer to untrusted users on projects with node-tool agents.
• Turn off command-execution nodes (Execute Command, SSH) if they were re-enabled.

Review agent chat and execution history in projects that have Project Viewers, and look for node executions triggered from chats by viewer accounts. Check which credentials those executions used. On the host, look for unexpected child processes of the n8n process if Execute Command or SSH nodes are enabled, and for outbound connections the project's credentials would normally make.

Impact

In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.

As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.

Users of the AI Agents feature who share team projects with lower-privileged members are affected.

Patches

The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable.
• Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.
• Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.