{"items":[{"id":"NVI-00016436","kind":"vulnerability","title":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-x5vx-c2c8-m3w9","CVE-2026-65015"],"plain_summary":"GitHub lists this reviewed advisory for n8n, n8n. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-28be5e15241db6df209fb319192c7840"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-29T19:17:25.600Z","value":"8.8 HIGH (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-28be5e15241db6df209fb319192c7840"},{"kind":"CVSS","as_of":"2026-10-29T19:17:25.600Z","value":"7.2 HIGH (4.0)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-28be5e15241db6df209fb319192c7840"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7076ae7ba3290fc1125b04ac360b2585","url":"https://github.com/advisories/GHSA-x5vx-c2c8-m3w9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-x5vx-c2c8-m3w9","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:39.734Z"},{"id":"sr-28be5e15241db6df209fb319192c7840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65015","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-65015","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T15:07:43.109Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7076ae7ba3290fc1125b04ac360b2585"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by ","public_affected_ranges":[">= 2.30.0, < 2.30.1"]},{"certainty":"source_listed","source_ids":["sr-7076ae7ba3290fc1125b04ac360b2585"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by ","public_affected_ranges":["< 2.29.8"]}],"null_published_at":"2026-11-08T19:53:44.042Z","source_updated_at":"2026-07-22T17:55:56.000Z","source_disclosed_at":"2026-07-22T17:55:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T22:34:39.734Z"},{"id":"NVI-00016436","kind":"vulnerability","title":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-x5vx-c2c8-m3w9","CVE-2026-65015"],"plain_summary":"GitHub lists this reviewed advisory for n8n, n8n. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7076ae7ba3290fc1125b04ac360b2585"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7076ae7ba3290fc1125b04ac360b2585","url":"https://github.com/advisories/GHSA-x5vx-c2c8-m3w9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-x5vx-c2c8-m3w9","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:39.734Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7076ae7ba3290fc1125b04ac360b2585"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by ","public_affected_ranges":[">= 2.30.0, < 2.30.1"]},{"certainty":"source_listed","source_ids":["sr-7076ae7ba3290fc1125b04ac360b2585"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nIn n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the `agent:execute` scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.\n\nAs a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.\n\nUsers of the AI Agents feature who share team projects with lower-privileged members are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable the AI Agents module by ","public_affected_ranges":["< 2.29.8"]}],"null_published_at":"2026-11-04T10:04:27.944Z","source_updated_at":"2026-07-22T17:55:56.000Z","source_disclosed_at":"2026-07-22T17:55:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:34:39.734Z"}],"next_cursor":null,"snapshot_revision":"42594"}