n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...

NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

EUVD-2026-47678

In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...

GHSA-725Q-C4VP-Q4CG Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g3r5-9h93-4j2c. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allow...

Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g3r5-9h93-4j2c. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allow...

GHSA-38FJ-36M5-783C Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

GHSA-W46P-W7W2-FR9G Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references. Original Description n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the...

Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gq66-9cw5-j5jm. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based...

Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-89gh-3pgc-v5h2. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data,...

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

GHSA-88C4-PCQM-3R9P Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gq66-9cw5-j5jm. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

CVE-2026-65596

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

CVE-2026-65015

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

EUVD-2026-47642

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...