GHSA-x5vx-c2c8-m3w9

Source

https://github.com/advisories/GHSA-x5vx-c2c8-m3w9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x5vx-c2c8-m3w9/GHSA-x5vx-c2c8-m3w9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x5vx-c2c8-m3w9

Aliases

CVE-2026-65015

Downstream

MINI-vj3f-rhm7-q3wq

Published

2026-07-22T17:55:55Z

Modified

2026-07-22T18:01:07.127281264Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L CVSS Calculator

Summary

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Details

Impact

In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.

As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.

Users of the AI Agents feature who share team projects with lower-privileged members are affected.

Patches

The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable. - Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled. - Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T17:55:55Z"
}

References

Affected packages

npm / n8n

Package

Name: n8n; View open source insights on deps.dev
Purl: pkg:npm/n8n

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.30.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x5vx-c2c8-m3w9/GHSA-x5vx-c2c8-m3w9.json"

npm / n8n

Package

Name: n8n; View open source insights on deps.dev
Purl: pkg:npm/n8n

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x5vx-c2c8-m3w9/GHSA-x5vx-c2c8-m3w9.json"