⚠ Withdrawn by GitHub Security Advisories

Withdrawn: July 22, 2026

GHSA-w46p-w7w2-fr9gHighDisclosed before NVD

Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool

Published
July 22, 2026
Last Modified
July 22, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-x5vx-c2c8-m3w9. This link is maintained to preserve external references.

Original Description

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

🎯 Affected products1

  • npm/n8n:< 2.29.8

🔗 References (4)