CyberRota Analysis
AI-GeneratedVersions of n8n prior to 2.30.1 are vulnerable to a privilege escalation flaw in the AI Agents feature, allowing a Project Viewer user to bypass authorization checks. This vulnerability enables unauthorized execution of arbitrary nodes and access to sensitive credential secrets. Organizations using n8n should prioritize patching to mitigate the risk of unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
Related CVEs
Other vulnerabilities affecting the same vendor(s)