CVE-2026-65015: n8n Project Viewer escalates

Q: Is CVE-2026-65015 actively exploited?

No confirmed active exploitation of CVE-2026-65015 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65015?

Upgrade n8n to version 2.30.1 or later immediately — this is the primary and only complete fix. Until patched, restrict or remove Project Viewer role access to any AI Agent workflow that has node tools enabled, and treat those workflows as admin/editor-only in the interim. Audit and rotate credentials referenced by any workflow accessible to Viewer-level users, since exposure may have already occurred. Enable and review n8n execution/audit logs for node executions triggered from chat/agent interactions by non-editor roles, and flag any unexpected node types being invoked by Viewer accounts. Apply least-privilege scoping to stored credentials (narrow API key permissions) so that even if harvested, their blast radius is limited.

Q: What systems are affected by CVE-2026-65015?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines, credential-integrated AI tool chains.

Q: What is the CVSS score for CVE-2026-65015?

No CVSS score has been assigned yet.

CISO Take

n8n's AI Agent feature fails to enforce authorization on its node-execution tool, so a low-privilege Project Viewer can simply chat with an agent that has node tools enabled and get it to run arbitrary workflow nodes, including nodes that read stored credential secrets. This matters because n8n is increasingly used as the orchestration layer wiring LLM agents into internal systems and SaaS integrations, so a Viewer-level account (contractor, junior analyst, anyone with read-only project access) becomes a path to full workflow execution and credential theft, not just a data-viewing risk. There's no CVSS score, EPSS data, or CISA KEV listing yet, and no public exploit or Nuclei template has surfaced, but the package carries a risk score of 69/100 and a mediocre 6.6/10 OpenSSF Scorecard, with 150 other CVEs recorded against n8n historically — this is a project with a track record of security gaps. Patch to n8n 2.30.1 immediately; until then, audit which Project Viewer accounts have access to AI Agent workflows with node tools enabled, and rotate any credentials referenced in workflows those Viewers can reach.

Sources: NVD GitHub Advisory CISA KEV OpenSSF ATLAS vulncheck.com

What is the risk?

Moderate-to-high risk despite the absence of a CVSS score or confirmed active exploitation. The attack requires only a low-privilege, already-authenticated account (Project Viewer) — no external network exploitation or social engineering of a privileged user is needed — which lowers the bar considerably compared to a typical privilege-escalation bug. The impact is severe: arbitrary node execution plus access to credential secrets effectively grants the attacker the workflow's full blast radius, including any downstream systems those credentials touch. Mitigating factors are that no public exploit or scanner template exists yet and it is not in CISA KEV, so this is not (yet) a mass-exploited bug — but the low bar for triggering it (a chat message) means it should be treated as high-priority patching, not deferred.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a legitimate but low-privilege Project Viewer account on the n8n instance.

AML.T0012

Tool Invocation Abuse

Attacker chats with an AI Agent workflow that has node tools enabled, instructing it to invoke the node-execution tool, which fails to verify the caller's authorization level.

AML.T0053

Credential Harvesting

The improperly authorized node execution reads out credential secrets stored in workflow node configurations.

AML.T0098

Impact / Lateral Movement

Attacker uses the harvested credentials to access connected systems (databases, SaaS, APIs) beyond n8n itself, escalating from view-only access to full workflow and downstream system compromise.

AML.T0091

Initial Access

Attacker obtains or already holds a legitimate but low-privilege Project Viewer account on the n8n instance.

AML.T0012

Tool Invocation Abuse

Attacker chats with an AI Agent workflow that has node tools enabled, instructing it to invoke the node-execution tool, which fails to verify the caller's authorization level.

AML.T0053

Credential Harvesting

The improperly authorized node execution reads out credential secrets stored in workflow node configurations.

AML.T0098

Impact / Lateral Movement

Attacker uses the harvested credentials to access connected systems (databases, SaaS, APIs) beyond n8n itself, escalating from view-only access to full workflow and downstream system compromise.

AML.T0091

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.30.0, < 2.30.1	`2.30.1`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade n8n to version 2.30.1 or later immediately — this is the primary and only complete fix. Until patched, restrict or remove Project Viewer role access to any AI Agent workflow that has node tools enabled, and treat those workflows as admin/editor-only in the interim. Audit and rotate credentials referenced by any workflow accessible to Viewer-level users, since exposure may have already occurred. Enable and review n8n execution/audit logs for node executions triggered from chat/agent interactions by non-editor roles, and flag any unexpected node types being invoked by Viewer accounts. Apply least-privilege scoping to stored credentials (narrow API key permissions) so that even if harvested, their blast radius is limited.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Leakage Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - Access control to AI system data and resources

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-65015?

n8n's AI Agent feature fails to enforce authorization on its node-execution tool, so a low-privilege Project Viewer can simply chat with an agent that has node tools enabled and get it to run arbitrary workflow nodes, including nodes that read stored credential secrets. This matters because n8n is increasingly used as the orchestration layer wiring LLM agents into internal systems and SaaS integrations, so a Viewer-level account (contractor, junior analyst, anyone with read-only project access) becomes a path to full workflow execution and credential theft, not just a data-viewing risk. There's no CVSS score, EPSS data, or CISA KEV listing yet, and no public exploit or Nuclei template has surfaced, but the package carries a risk score of 69/100 and a mediocre 6.6/10 OpenSSF Scorecard, with 150 other CVEs recorded against n8n historically — this is a project with a track record of security gaps. Patch to n8n 2.30.1 immediately; until then, audit which Project Viewer accounts have access to AI Agent workflows with node tools enabled, and rotate any credentials referenced in workflows those Viewers can reach.

Is CVE-2026-65015 actively exploited?

No confirmed active exploitation of CVE-2026-65015 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65015?

Upgrade n8n to version 2.30.1 or later immediately — this is the primary and only complete fix. Until patched, restrict or remove Project Viewer role access to any AI Agent workflow that has node tools enabled, and treat those workflows as admin/editor-only in the interim. Audit and rotate credentials referenced by any workflow accessible to Viewer-level users, since exposure may have already occurred. Enable and review n8n execution/audit logs for node executions triggered from chat/agent interactions by non-editor roles, and flag any unexpected node types being invoked by Viewer accounts. Apply least-privilege scoping to stored credentials (narrow API key permissions) so that even if harvested, their blast radius is limited.

What systems are affected by CVE-2026-65015?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines, credential-integrated AI tool chains.

What is the CVSS score for CVE-2026-65015?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation / orchestration pipelinescredential-integrated AI tool chains

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

Exploitation Scenario

An attacker (or a disgruntled/compromised low-privilege contractor) holds only a Project Viewer account on a shared n8n instance — enough to view but nominally not to execute or edit workflows. They open an AI Agent workflow that has node tools enabled and start a chat session with the agent. Because the node-execution tool doesn't verify the caller's actual authorization level, the attacker crafts a message instructing the agent to invoke a node that reads out stored credentials (e.g., a database connector or an API-key-configured HTTP node). The agent complies, returning secrets the Viewer role was never meant to access. The attacker now has valid credentials for connected systems and uses them for lateral movement, data exfiltration, or further privilege escalation outside of n8n entirely.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.