n8n AI Agent Node-Execution Privilege Escalation

Technical Analysis

The AI Agent feature in n8n exposes underlying workflow nodes as callable tools to the LLM-driven agent, but the node-execution tool path does not verify that the invoking user's role (e.g., Project Viewer) is authorized to execute the underlying node or access its associated credentials. An attacker with only viewer-level access can craft chat messages to the agent that induce it to invoke privileged nodes, effectively using the agent as a confused deputy to bypass n8n's RBAC layer. This crosses a trust boundary between the conversational interface (human-to-agent) and the tool-execution layer (agent-to-workflow-engine), where authorization should normally be enforced but is not. The attacker gains arbitrary node execution and exposure of credential secrets tied to those nodes, potentially leading to full compromise of connected third-party services and lateral movement within automated workflows.

Affected Systems

n8n

Detection Signatures

• Look for Project Viewer-role accounts initiating AI Agent chat sessions followed by execution of nodes outside their normal workflow scope
• Audit logs showing node execution or credential access events with a user/session role mismatch (viewer-role triggering execute-level actions)
• Unexpected credential retrieval events correlated with AI Agent chat interactions
• Anomalous tool-call patterns where agent invokes node types unrelated to the stated chat context

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n version 2.30.1 or later, which fixes the missing authorization check on the AI Agent node-execution tool.

2. 2

   Restrict AI Agent node tools

   Until patched, disable or restrict node tools available to AI Agents in projects accessible to Viewer-role users.

3. 3

   Audit role permissions

   Review Project Viewer role assignments and ensure they cannot access workflows containing sensitive credentials or privileged nodes.

4. 4

   Enable execution auditing

   Turn on detailed audit logging for AI Agent chat sessions and node executions to detect anomalous privilege use.

5. 5

   Rotate exposed credentials

   If exploitation is suspected, rotate all credentials accessible via workflows that had AI Agent node tools enabled.