{"id":"CVE-2026-65015","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-22T12:18:18.587","lastModified":"2026-10-29T19:17:25.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification."},{"lang":"es","value":"Versiones de n8n anteriores a la 2.30.1 contienen una vulnerabilidad de escalada de privilegios en la función de Agentes de IA donde la herramienta de ejecución de nodos carece de comprobaciones de autorización adecuadas. Un usuario con rol de Visor de Proyecto puede escalar privilegios al chatear con un agente que tiene las herramientas de nodo habilitadas, ejecutando nodos arbitrarios y accediendo a secretos de credenciales sin la verificación de autorización adecuada."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"n8n-io","product":"n8n","defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","versions":[{"version":"2.30.0","lessThan":"2.30.1","versionType":"semver","status":"affected"},{"version":"2.30.1","versionType":"semver","status":"unaffected"}]},{"vendor":"n8n-io","product":"n8n","defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","versions":[{"version":"0","lessThan":"2.29.8","versionType":"semver","status":"affected"},{"version":"2.29.8","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-22T18:20:14.424938Z","id":"CVE-2026-65015","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*","versionEndExcluding":"2.29.8","matchCriteriaId":"FAD58B22-8643-4BEA-B0CA-21AD13FA02F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*","versionEndExcluding":"2.29.8","matchCriteriaId":"9138B0FD-A50E-4E58-AA0D-A0595EA9B685"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*","matchCriteriaId":"E125F7EF-F72F-427F-82DE-D6A505B1DF8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*","matchCriteriaId":"3C2780A0-55EC-488D-9149-EE83BA246A38"}]}]}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9","source":"disclosure@vulncheck.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool","source":"disclosure@vulncheck.com","tags":["Third Party Advisory","VDB Entry"]}]}