GHSA-x5vx-c2c8-m3w9: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Summary

A user with the read-only Project Viewer role in n8n's AI Agents feature could escalate privileges by chatting with an agent that has node tools enabled. The run_node_tool path was authorized only by the agent:execute scope, so it ran nodes with project credentials without checking the requesting user's node-execution or credential-access rights. On instances with Execute Command or SSH enabled, this could extend to arbitrary command execution on the n8n host.

Mitigation

The issue is fixed in n8n versions 2.29.8 and 2.30.1; users should upgrade to one of these or later. If upgrading is not immediately possible, administrators may temporarily remove `agents` from the `N8N_ENABLED_MODULES` environment variable, restrict project membership to fully trusted users, and disable command-execution nodes such as Execute Command and SSH. The source states these workarounds do not fully remediate the risk.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Topics

• AI agents

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database