Auth bypass in N8n-io N8n
CVE-2026-65015
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that…
Vulnerability class: Broken Access Control
Affected products
- N8n-io N8n — versions 0, 2.30.1, 2.29.8
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)