CVE-2026-65015CWE-863

n8n before 2.30.1 Privilege Escalation via run_node_tool

High · published July 22, 2026

CVSS v4.0
7.2
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
EPSS
0.00608 · 48.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-22T11:21Z
EPSS history
Timeline
  • 22 JUL 11:21Z
    n8n before 2.30.1 Privilege Escalation via run_node_tool
    cvelistv5