AI agents

A user with the read-only Project Viewer role in n8n's AI Agents feature could escalate privileges by chatting with an agent that has node tools enabled. The run_node_tool path was authorized only by the agent:execute scope, so it ran nodes with project credentials without checking the requesting user's node-execution or credential-access rights. On instances with Execute Command or SSH enabled, this could extend to arbitrary command execution on the n8n host.

This advisory is a withdrawn duplicate of GHSA-x5vx-c2c8-m3w9. The original description states that n8n versions before 2.30.1 contain a privilege escalation flaw in the AI Agents feature, where the node-execution tool lacks proper authorization checks. A Project Viewer user can chat with an agent that has node tools enabled, execute arbitrary nodes and access credential secrets without authorization verification.

Two inbound-mail handlers in AgenticMail's @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core and @agenticmail/openclaw packages act on privileged effects without checking that the sender is the operator, unlike a sibling handler that does. The most serious path lets any external email routed to the bridge inbox resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding attacker-controlled `from`, `subject` and `preview` fields into the prompt the agent reads.

CVE-2026-57494 affects @agenticmail/api before version 0.9.64. A low-privileged authenticated agent can list another agent's pending and claimed tasks through GET /api/agenticmail/tasks/pending?assignee=<name>, which returns task IDs and payloads. Those IDs can then be used on the /tasks/:id/claim, /result, /complete and /fail endpoints to act on tasks assigned to a different agent, because agent names are discoverable via GET /api/agenticmail/accounts/directory.

CVE-2026-47255 affects @agenticmail/api before 0.9.32 and @agenticmail/core before 0.9.10, which give AI agents real email addresses and phone numbers. The source describes several weaknesses in these packages, including inactive-agent hour filtering, storage SQL identifier validation, metadata-backed ownership checks for raw storage SQL, and SMTP envelope/header control-character validation. It also notes that TLS certificate verification for MailSender was not the default before the fix.

Agentic-Flow, an AI agent orchestration platform, is affected in versions prior to 2.0.14. Several MCP server tool files interpolate attacker-influenceable parameters such as agent, task, name, language and agentdb directly into shell command strings passed to execSync(). This allows arbitrary OS command execution with the privileges of the MCP server user.

CVE-2026-59207 is a vulnerability in n8n, an open source workflow automation platform, affecting versions before 2.27.4 and 2.28.1. The AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. A member-level user with use-only access to a shared credential could send its secret to an external server they control.

CVE-2026-44934 is an information disclosure flaw in SUSE Rancher AI Agent 1.0 before 1.0.2. When the DEBUG loglevel is set, API keys or LLM response text, which may contain sensitive data, are written to log files. A local attacker who can read those logs could misuse the exposed data or credentials. SUSE rates it CVSS 4.0 7.0 (HIGH), and NVD has not yet provided an assessment.

Claude Code versions 2.1.38 through 2.1.163 allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Through symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files such as .zshenv in the user's home directory, leading to code execution outside seatbelt sandbox restrictions. Reliable exploitation required the user to clone a malicious repository containing prompt injection content and run Claude Code against it.

agentic-flow versions <= 2.0.13 interpolated MCP tool parameters such as agent, task, name, language and agentdb arguments directly into shell command strings passed to execSync(). A malicious value can break out of the double-quoted argument and run arbitrary OS commands with the privileges of the user running the MCP server. The HTTP/SSE transports expose the same sinks without authentication or Origin/Host validation.

CVE-2026-50287 affects @agenticmail/mcp before version 0.9.27 when started with --http or MCP_HTTP=1, which enables a Streamable HTTP transport. The /mcp endpoint accepts requests without any HTTP authentication layer, so a remote client can initialize a session and call tools directly. GitHub, Inc. rates it CVSS-B 8.7 HIGH (CVSS:4.0), with high confidentiality impact and no privileges or user interaction required.