{"id":"EUVD-2026-47631","enisaUuid":"3b2a42ca-4b50-323d-bf21-b91011459773","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","datePublished":"Jul 22, 2026, 11:21:38 AM","dateUpdated":"Oct 29, 2026, 9:16:19 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool\n","aliases":"CVE-2026-65015\nGHSA-w46p-w7w2-fr9g\nGHSA-x5vx-c2c8-m3w9\n","assigner":"VulnCheck","epss":0.61,"enisaIdProduct":[{"id":"1e774dce-1de4-331c-aab4-586889a3cd3b","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c2.29.8"},{"id":"5d30af49-e3b0-378b-86e9-7cf11d14508c","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"}],"enisaIdVendor":[{"id":"7b69961a-cd8f-3c33-8c80-3b8c770ad09e","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"1a588fdf-ca8c-3781-b606-e3a98623da27","vulnerability":{"id":"GHSA-x5vx-c2c8-m3w9","description":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","datePublished":"Jul 22, 2026, 5:55:55 PM","dateUpdated":"Jul 22, 2026, 5:55:55 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65015\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool\n","enisa_id":"EUVD-2026-47631\n","aliases":"GHSA-x5vx-c2c8-m3w9\nCVE-2026-65015\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5c328820-40b5-36db-9cb8-555b65336e05","vulnerability":{"id":"CVE-2026-65015","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.","datePublished":"Jul 22, 2026, 11:21:38 AM","dateUpdated":"Oct 29, 2026, 9:16:19 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool\n","enisa_id":"EUVD-2026-47631\n","assigner":"VulnCheck","epss":0.61,"dataProcessed":"Nov 3, 2026, 7:15:24 AM","vulnerabilityProduct":[{"id":"45d825c0-8eb5-3737-83ad-1b35ed2fbfab","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c2.29.8"},{"id":"7264deb0-71bc-33ee-9b0f-7c0931a515de","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"}],"vulnerabilityVendor":[{"id":"9ada636d-943b-3515-b4fc-bd4494af8f7e","vendor":{"name":"n8n-io"}}]}},{"id":"e5ffb175-a523-321e-a130-82dd6bbfe4b6","vulnerability":{"id":"GHSA-w46p-w7w2-fr9g","description":"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool","datePublished":"Jul 22, 2026, 12:32:17 PM","dateUpdated":"Jul 22, 2026, 5:54:31 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65015\nhttps://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool\n","enisa_id":"EUVD-2026-47631\n","aliases":"GHSA-w46p-w7w2-fr9g\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}