CVE-2026-65015: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

In n8n’s AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent’s node-execution tool was authorized only by the agent:execute scope and ran nodes using the project’s credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.

As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.

Users of the AI Agents feature who share team projects with lower-privileged members are affected.