CVE-2026-65015 Overview
CVE-2026-65015 is a privilege escalation vulnerability affecting n8n versions before 2.30.1. The flaw resides in the AI Agents feature, specifically the node-execution tool, which fails to enforce proper authorization checks [CWE-863]. A user assigned the low-privileged Project Viewer role can escalate privileges by interacting with an AI agent that has node tools enabled. Through this interaction, the attacker executes arbitrary workflow nodes and accesses credential secrets that should be restricted to higher-privileged roles.
Critical Impact
Authenticated low-privilege users can execute arbitrary nodes and exfiltrate stored credential secrets by chatting with an AI agent, bypassing role-based access controls.
Affected Products
- n8n versions prior to 2.30.1
- n8n deployments with AI Agents feature enabled
- n8n workflows exposing node-execution tools to agents
Discovery Timeline
- 2026-07-22 - CVE-2026-65015 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-65015
Vulnerability Analysis
The vulnerability stems from missing authorization enforcement in the AI Agents node-execution tool. n8n uses role-based access control to restrict who can execute workflow nodes and access credentials. The Project Viewer role is intended to grant read-only access to project resources without permission to run nodes or read secret material.
When an AI agent is configured with node tools enabled, the agent can invoke workflow nodes on behalf of the requesting user. The node-execution tool does not verify whether the requesting user holds the permissions required to execute those nodes or read the associated credentials. This design gap allows a Project Viewer to trigger privileged operations by conversing with the agent.
Because n8n nodes frequently store API keys, database credentials, and OAuth tokens, this authorization gap converts an AI conversation into an arbitrary credential exfiltration channel. The vulnerability is classified as CWE-863: Incorrect Authorization.
Root Cause
The node-execution tool inside the AI Agents subsystem performs execution without evaluating the caller's role against the resource being accessed. Authorization is checked at the workflow editor layer but not at the tool-invocation layer used by agents. This inconsistency creates a confused deputy condition in which the agent acts with higher effective permissions than its invoker.
Attack Vector
An authenticated attacker with Project Viewer access selects a project containing an AI agent configured with node tools. The attacker sends chat prompts instructing the agent to run specific nodes or return credential values. The agent, executing under insufficient authorization checks, complies and returns node output including credential secrets. The attack requires network access, low privileges, and no user interaction from other users.
See the GitHub Security Advisory and VulnCheck Privilege Escalation Advisory for additional technical details.
Detection Methods for CVE-2026-65015
Indicators of Compromise
- Chat sessions from Project Viewer accounts invoking node-execution tools on AI agents
- Unexpected node executions initiated through agent chat endpoints rather than the workflow editor
- Credential read events correlated with low-privilege user sessions
- Outbound requests from n8n nodes triggered outside normal workflow schedules
Detection Strategies
- Audit n8n execution logs for node runs whose initiator holds only the Project Viewer role
- Correlate AI agent chat activity with credential access events in the n8n audit trail
- Alert on any credential decryption event tied to a user role not authorized to view secrets
- Review workflow execution history for agent-triggered runs that access sensitive credentials
Monitoring Recommendations
- Ingest n8n audit and execution logs into a centralized SIEM for role-versus-action correlation
- Establish a baseline of expected agent chat volumes per user role and alert on deviations
- Monitor egress traffic from n8n hosts for anomalous destinations that may indicate credential misuse
How to Mitigate CVE-2026-65015
Immediate Actions Required
- Upgrade all n8n instances to version 2.30.1 or later without delay
- Audit existing AI agents and disable node-execution tools where they are not strictly required
- Review Project Viewer role assignments and remove users who do not require ongoing access
- Rotate any credentials stored in n8n projects that were accessible to AI agents before the upgrade
Patch Information
n8n resolved the issue in version 2.30.1 by adding authorization checks to the node-execution tool. The fix ensures the tool validates the invoking user's role and permissions before executing nodes or exposing credential values. Refer to the GitHub Security Advisory GHSA-x5vx-c2c8-m3w9 for the vendor's remediation notes.
Workarounds
- Disable the AI Agents feature until the upgrade to 2.30.1 or later is complete
- Remove node-execution tools from all agent configurations in shared projects
- Restrict project membership so that only trusted roles have access to projects containing agents
- Segregate sensitive credentials into projects that do not host AI agents with node tools
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
