CVE-2026-65015 n8n before 2.30.1 Privilege Escalation via run_node_tool

What is CVE-2026-65015?

CVE-2026-65015 is a high-severity vulnerability in N8n N8n, published on 22 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

Weakness: CWE-863

Which versions are affected by CVE-2026-65015?

4 open source packages ship an affected version, including n8n. It affects 1 product.

Products include N8n N8n.

How do I fix CVE-2026-65015?

Upgrade n8n to a fixed version for your release line: 2.29.8 or 2.30.1.

Is CVE-2026-65015 being exploited?

There is no known exploitation of CVE-2026-65015 in the wild and no public exploit code.

Other vulnerabilities in N8n N8n

• CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources Exploited Critical 10.0
• CVE-2026-21877 n8n is vulnerable to Remote Code Execution via Arbitrary File Write Critical 10.0
• CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling Critical 10.0
• CVE-2026-1470 n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution Critical 9.9
• CVE-2025-68668 n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node Critical 9.9

All N8n N8n vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x5vx-c2c8-m3w9, MINI-vj3f-rhm7-q3wq, ROOT-APP-NPM-CVE-2026-65015.