n8n CVE-2026-65015

Exploitation requires an authenticated low-privileged account (Project Viewer, PR:L) within an n8n project, AND an AI Agent in that project that has been configured with node tools enabled - this is the AT:P attack requirement and the single most important limiter, since agents without node tools cannot invoke the vulnerable run-node path. The attacker triggers the flaw purely by chatting with that agent (UI:N, network-reachable), so no victim interaction or elevated privileges are needed. Limiting factors: it is not exploitable against a default install with no node-tool-enabled agents, and it requires prior access to the tenant/project rather than being an unauthenticated internet-facing bug; instances that only grant node-enabled agents to trusted roles, or that run single-user, are not realistically exposed.

The signals are moderately consistent with a real but bounded threat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, VC:H, SC:H) yields 7.2 (High): network-reachable, low attacker privileges (an existing Project Viewer account), no user interaction, but with an attack requirement (AT:P) - the target agent must already be configured with node tools enabled. Confidentiality impact is high on both the vulnerable system and a subsequent system (SC:H), reflecting credential theft that can pivot to connected services. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure appears low today. The key limiter is that exploitation is not against a default deployment: the attacker needs a valid low-privilege account in the same project AND an AI agent that an administrator has already wired up with node tools. This makes it a genuine insider/tenant-isolation concern for multi-user n8n instances rather than a mass-exploitable internet risk.

An attacker with only a Project Viewer account on a shared n8n instance opens an AI Agent that an administrator has configured with node tools and simply asks it, in chat, to run a node that uses a stored credential. Because the run-node tool skips authorization verification, the agent executes the node and returns or acts on secrets the viewer was never authorized to see, letting the attacker harvest API keys or tokens for connected systems. No public POC is currently identified, but the attack requires no special tooling beyond chat access.