| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | = 2.30.0< 2.29.8 | 2.29.8 |
| n8n | ≥ 2.30.0, < 2.30.1< 2.29.8 | 2.30.12.29.8 |
In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials, without verifying that the requesting user was permitted to execute nodes or to access those credentials.
As a result, a Project Viewer could execute arbitrary tool nodes on the server and use credential secrets they were not authorized to read, gaining execution capabilities their role is intended to deny. On instances where a command- or file-capable tool node (such as Execute Command or SSH) is enabled, this could be extended to arbitrary command execution on the n8n host.
Users of the AI Agents feature who share team projects with lower-privileged members are affected.
The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
agents from the N8N_ENABLED_MODULES environment variable.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free