Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2026-65015

Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
22/07/2026
Last modified:
22/07/2026

Description

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

Impact

Vector 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L CVSS v4.0 Severity and Metrics:

Base Score: 7.20 HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): Low
User Interaction (UI): None
Confidentiality (VC): High
Integrity (VI): Low
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): Low
Availability (SA): Low

Base Score 4.0
7.20
Severity 4.0
HIGH

References to Advisories, Solutions, and Tools