n8n AI Agents Privilege Escalation via run_node_tool (Duplicate Advisory)

Technical Analysis

The vulnerability lies in the tool-layer of n8n's AI Agents feature, specifically the run_node_tool used for node execution triggered via conversational agent interaction. The tool fails to verify that the requesting user's role (Project Viewer) has sufficient privileges before executing workflow nodes on their behalf, effectively letting the agent act as a confused deputy. By simply chatting with an agent that has node tools enabled, a low-privileged user can direct it to run arbitrary nodes, crossing the boundary between conversational input and privileged backend execution, and thereby retrieve stored credential secrets. This is a classic authorization-check gap at the tool invocation layer rather than a model or prompt-injection issue.

Affected Systems

n8n

Detection Signatures

• Monitor for Project Viewer-role users invoking node-execution/run_node_tool actions via AI Agent chat interfaces
• Log entries showing chat-triggered node executions that access credential/secret stores
• Unexpected credential retrieval events correlated with AI Agent conversation sessions
• Alert on node tool invocations lacking corresponding elevated-role authorization tokens

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n version 2.30.1 or later, which includes the fix for this vulnerability (tracked under the canonical advisory GHSA-x5vx-c2c8-m3w9).

2. 2

   Restrict AI Agent node tool access

   Disable or limit node-execution tools for AI Agents in projects where Viewer-level users have chat access, until patched.

3. 3

   Enforce role-based authorization on tool calls

   Ensure all agent tool invocations re-validate the calling user's role and permissions server-side, not just at the UI layer.

4. 4

   Audit credential exposure

   Review logs for any Project Viewer accounts that may have already exploited this issue to access credential secrets, and rotate any potentially exposed credentials.