n8n AI Agents: Project Viewer node-exec (CVE-2026-65015) and MCP credential leak (CVE-2026-59207)

Antonio De Turris (deturris.io, 14 September 2026) details two authorization bypasses in n8n’s AI Agents feature. CVE-2026-65015: a read-only Project Viewer can instruct an agent’s run_node_tool to execute arbitrary n8n nodes (including HTTP Request) with the project’s credentials; if Execute Command is enabled on self-hosted, that path can reach host command execution. Affected: all versions before 2.29.8, plus 2.30.0; fixed in 2.29.8 and 2.30.1. GitHub GHSA-x5vx-c2c8-m3w9 rates High (CVSS 4.0 overall 7.2). CVE-2026-59207: the agent MCP client sends credential headers without enforcing “Allowed HTTP Request Domains”, so a use-only credential holder can point MCP at an attacker host and exfiltrate the secret. Affected: all before 2.27.4, plus 2.28.0; fixed in 2.27.4 and 2.28.1. GHSA-h44j-f5r5-ph73 High (CVSS 4.0 overall 7.1). Reported June 2026; vendor advisories published with the fixes. Primary: researcher writeup; vendor: n8n GitHub security advisories.

Product

n8n (self-hosted / Enterprise project AI Agents; MCP connector)

Versions

CVE-2026-65015: <2.29.8 and 2.30.0 (fix 2.29.8 / 2.30.1). CVE-2026-59207: <2.27.4 and 2.28.0 (fix 2.27.4 / 2.28.1)

CVSS

7.2 (CVE-2026-65015 GHSA); 7.1 (CVE-2026-59207 GHSA)

Exploited in Australia?

unknown

Patch to

Upgrade n8n to 2.30.1+ (or 2.29.8+ on 2.29 train); keep Execute Command disabled unless required; review Project Viewer membership and MCP credential bindings

Primary: De Turris — n8n AI Agents authorization bypasses (14 Sep 2026) · Vendor: n8n GHSA-x5vx-c2c8-m3w9 (CVE-2026-65015) · CVE: CVE-2026-65015, CVE-2026-59207 · n8n GHSA-h44j-f5r5-ph73 (CVE-2026-59207)

tech ai cloud identity