Sign in
Deutsch English Español Polski
High

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

  • Disclosed: 22.07.2026
  • Updated: 11.10.2026 10:22

Impact

In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.

As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.

Users of the AI Agents feature who share team projects with lower-privileged members are affected.

Patches

The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable.
  • Restrict project membership to fully trusted users only, and avoid granting Project Viewer access to untrusted users on projects containing agents with node tools enabled.
  • Disable command-execution nodes (e.g. Execute Command, SSH) if they have been re-enabled, to limit the potential impact.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package n8n >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
Weakness (CWE)
CWE-863
Platform
npm
Package
n8n
Disclosed
22.07.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x5vx-c2c8-m3w9 - CC BY 4.0

Vulnerability history: n8n

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (156) in the archive
Total entries
156
First → latest
05.2023 09.2026
Without a fix
1
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 58
  • Medium 74

Disclosures per year

Severity:
  1. n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    High CVE-2026-86083 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  2. n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    High CVE-2026-86082 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  3. n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    High CVE-2026-86081 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  4. n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    High CVE-2026-86075 >= 2.38.0, < 2.38.2, < 2.37.7 2.38.2, 2.37.7
  5. n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
    High CVE-2026-86076 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  6. n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
    High CVE-2026-72749 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  7. n8n: Edit Image Node Format Injection Allows Arbitrary File Write
    High CVE-2026-72762 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  8. n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
    High CVE-2026-72763 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  9. n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
    High CVE-2026-72774 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  10. n8n: Expression sandbox escape via arrow-function bodies enabling command execution
    High CVE-2026-72765 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  11. n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
    High CVE-2026-72766 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  12. n8n: Authenticated code execution in the n8n Git node
    High CVE-2026-72767 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  13. n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
    High CVE-2026-72770 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  14. n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
    High CVE-2026-72771 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  15. n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
    High CVE-2026-72772 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  16. n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
    High CVE-2026-65016 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  17. n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
    High CVE-2026-65591 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  18. n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
    High CVE-2026-65595 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  19. n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    High CVE-2026-59208 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  20. n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
    High CVE-2026-59207 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  21. n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
    High CVE-2026-59206 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  22. n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
    High CVE-2026-59209 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  23. n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
    High CVE-2026-65592 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  24. n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
    High CVE-2026-65597 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  25. n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
    High CVE-2026-65598 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  26. n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool this entry
    High CVE-2026-65015 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  27. n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
    High · 7.7 CVE-2026-54304 < 1.123.55, >= 2.26.0, < 2.26.1, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.1, 2.25.7
  28. n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
    High · 10.0 CVE-2026-54309 >= 2.26.0, < 2.26.2, < 2.25.7 2.26.2, 2.25.7
  29. n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
    High · 9.9 CVE-2026-54305 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  30. n8n: Credential Exfiltration via Permission Bypass
    High · 9.6 CVE-2026-54307 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  31. n8n: Stored XSS in Chat Trigger Node
    High · 7.6 CVE-2026-54302 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  32. n8n: Microsoft SQL Node Prototype Pollution
    High · 8.5 CVE-2026-54312 < 2.24.0 2.24.0
  33. n8n: Same-Origin XSS in Respond to Webhook Node
    High · 7.6 CVE-2026-54301 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  34. n8n: Python sandbox escape
    High · 8.5 CVE-2026-49444 < 1.123.48, >= 2.22.0, < 2.22.4, >= 2.0.0-rc.0, < 2.21.8 1.123.48, 2.22.4, 2.21.8
  35. n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    High · 8.1 CVE-2026-45732 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  36. n8n Has a Source Control Pull SQL Injection
    High · 9.0 CVE-2026-44792 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  37. n8n Has an XML Node Prototype Pollution Patch Bypass
    Critical · 9.9 CVE-2026-44791 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  38. n8n Has an Arbitrary File Read via Git Node
    Critical · 8.8 CVE-2026-44790 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  39. n8n: HTTP Request Node Pagination Prototype Pollution to RCE
    Critical · 9.9 CVE-2026-44789 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  40. n8n has XML Node Prototype Pollution that to RCE
    Critical · 9.9 CVE-2026-42232 >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4, < 1.123.32 2.18.1, 2.17.4, 1.123.32
  41. n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
    Critical · 10.0 CVE-2026-42231 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  42. n8n Vulnerable to XSS via MCP OAuth client
    High · 8.2 CVE-2026-42235 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  43. n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
    High · 8.5 CVE-2026-42226 >= 2.17.0, < 2.17.5, < 1.123.33 2.17.5, 1.123.33
  44. n8n has a Python Task Runner Sandbox Escape Vulnerability
    High · 7.5 CVE-2026-42234 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  45. n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
    High · 7.5 CVE-2026-42236 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.0.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  46. n8n has SQL Injection in Data Table Node via orderByColumn Expression
    High · 9.9 CVE-2026-33713 < 1.123.26, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.26, 2.14.1, 2.13.3
  47. n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
    Critical · 9.9 CVE-2026-33696 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  48. n8n Has External Secrets Authorization Bypass in Credential Saving
    High · 6.3 CVE-2026-33722 < 1.123.23, >= 2.0.0-rc.0, < 2.6.4 1.123.23, 2.6.4
  49. n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
    High · 8.2 CVE-2026-33665 >= 2.0.0-rc.0, < 2.4.0, < 1.121.0 2.4.0, 1.121.0
  50. n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
    High · 9.9 CVE-2026-33663 < 1.123.27, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.27, 2.14.1, 2.13.3
  51. n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
    Critical · 9.9 CVE-2026-33660 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  52. n8n has In-Process Memory Disclosure in its Task Runner
    High · 6.5 CVE-2026-27496 < 1.123.22, >= 2.10.0, < 2.10.1, >= 2.0.0-rc.0, < 2.9.3 1.123.22, 2.10.1, 2.9.3
  53. n8n Vulnerable to Stored XSS via Various Nodes
    High · 5.4 CVE-2026-27578 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  54. n8n: Expression Sandbox Escape Leads to RCE
    Critical · 9.9 CVE-2026-27577 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  55. n8n has Arbitrary Command Execution via File Write and Git Operations
    Critical · 8.5 CVE-2026-27498 < 1.123.8, >= 2.0.0, < 2.2.0 1.123.8, 2.2.0
  56. n8n has Potential Remote Code Execution via Merge Node
    Critical · 9.9 CVE-2026-27497 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  57. n8n has a Sandbox Escape in its JavaScript Task Runner
    Critical CVE-2026-27495 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  58. n8n has Arbitrary File Read via Python Code Node Sandbox Escape
    High · 9.9 CVE-2026-27494 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  59. n8n has Unauthenticated Expression Evaluation via Form Node
    Critical · 9.0 CVE-2026-27493 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  60. n8n has a Python sandbox escape
    Critical · 9.9 CVE-2026-25115 < 2.4.8 2.4.8
  61. n8n Merge Node has Arbitrary File Write leading to RCE
    Critical CVE-2026-25056 < 1.118.0, >= 2.0.0, < 2.4.0 1.118.0, 2.4.0
  62. n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
    High CVE-2026-25055 >= 2.0.0, < 2.4.0, < 1.123.12 2.4.0, 1.123.12
  63. n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
    High CVE-2026-25054 >= 2.0.0, < 2.2.1, < 1.123.9 2.2.1, 1.123.9
  64. n8n has OS Command Injection in Git Node
    Critical CVE-2026-25053 >= 2.0.0, < 2.5.0, < 1.123.10 2.5.0, 1.123.10
  65. n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
    Critical CVE-2026-25052 >= 2.0.0, < 2.5.0, < 1.123.18 2.5.0, 1.123.18
  66. n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
    High CVE-2026-25051 >= 1.123.0, < 1.123.2, < 1.122.5 1.123.2, 1.122.5
  67. n8n Has Expression Escape Vulnerability Leading to RCE
    Critical CVE-2026-25049 < 1.123.17, >= 2.0.0, < 2.5.2 1.123.17, 2.5.2
  68. n8n Vulnerable to Command Injection in Community Package Installation
    Critical CVE-2026-21893 >= 0.187.0, < 1.120.3 1.120.3
  69. n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
    High · 7.7 CVE-2025-61917 >= 1.65.0, < 1.114.3 1.114.3
  70. n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
    Critical · 9.9 CVE-2026-1470 < 1.123.17, >= 2.0.0, < 2.4.5, >= 2.5.0, < 2.5.1 1.123.17, 2.4.5, 2.5.1
  71. n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
    Critical · 10.0 CVE-2026-21858 >= 1.65.0, < 1.121.0 1.121.0
  72. n8n Vulnerable to RCE via Arbitrary File Write
    Critical · 9.9 CVE-2026-21877 >= 0.123.0, < 1.121.3 1.121.3
  73. Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
    High · 7.1 CVE-2025-68697 >= 1.2.1, < 2.0.0 2.0.0
  74. n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
    Critical · 9.9 CVE-2025-68668 >= 1.0.0, < 2.0.0 2.0.0
  75. n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
    High · 7.3 CVE-2025-61914 < 1.114.0 1.114.0
  76. n8n Vulnerable to Remote Code Execution via Expression Injection
    Critical · 9.9 Exploited in attacks CVE-2025-68613 >= 0.211.0, < 1.120.4, >= 1.121.0, < 1.121.1 1.120.4, 1.121.1
  77. n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
    Critical CVE-2025-65964 >= 0.123.1, < 1.119.2 1.119.2
  78. n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
    High · 8.8 CVE-2025-62726 < 1.113.0 1.113.0
  79. n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
    High · 8.8 CVE-2025-71380 <= 1.114.4 no fix
  80. Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
    High · 8.7 CVE-2025-52478 >= 1.77.0, < 1.98.2 1.98.2
  81. n8n Information Disclosure vulnerability
    High · 7.5 CVE-2023-27564 < 0.216.1 0.216.1
  82. n8n Privilege Escalation vulnerability
    High · 8.8 CVE-2023-27563 < 0.216.1 0.216.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.