n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9 Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.2 · n8nNVD modified 2026-10-24 17:10
Affected (CPE criteria) 4
cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*
References 2
- https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9 Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool Third Party Advisory, VDB Entry