Update to Drupal 8.0.3. For more information, see https://www.drupal.org/drupal-8.0.3-release-notes

core/modules/node/node.module

@@ -883,7 +883,9 @@ function node_form_system_themes_admin_form_submit($form, FormStateInterface $fo
  * with node access to ensure only nodes to which the user has access are
  * retrieved, through the use of hook_query_TAG_alter(). See the
  * @link entity_api Entity API topic @endlink for more information on entity
- * queries.
+ * queries. Tagging a query with "node_access" does not check the
+ * published/unpublished status of nodes, so the base query is responsible
+ * for ensuring that unpublished nodes are not displayed to inappropriate users.
  *
  * Note: Even a single module returning an AccessResultInterface object from
  * hook_node_access() whose isForbidden() method equals TRUE will block access

core/modules/node/src/NodeGrantDatabaseStorage.php

@@ -65,6 +65,11 @@ class NodeGrantDatabaseStorage implements NodeGrantDatabaseStorageInterface {
    * {@inheritdoc}
    */
   public function access(NodeInterface $node, $operation, AccountInterface $account) {
+    // Grants only support these operations.
+    if (!in_array($operation, ['view', 'update', 'delete'])) {
+      return AccessResult::neutral();
+    }
+
     // If no module implements the hook or the node does not have an id there is
     // no point in querying the database for access grants.
     if (!$this->moduleHandler->getImplementations('node_grants') || !$node->id()) {

core/modules/node/src/Tests/Migrate/d7/MigrateNodeTest.php

@@ -39,6 +39,7 @@ class MigrateNodeTest extends MigrateDrupal7TestBase {
     $this->installEntitySchema('node');
     $this->installEntitySchema('comment');
     $this->installEntitySchema('taxonomy_term');
+    $this->installEntitySchema('file');
     $this->installConfig(static::$modules);
     $this->installSchema('node', ['node_access']);
     $this->installSchema('system', ['sequences']);
@@ -51,6 +52,7 @@ class MigrateNodeTest extends MigrateDrupal7TestBase {
       'd7_field',
       'd7_field_instance',
       'd7_node__test_content_type',
+      'd7_node__article',
     ]);
   }
 
@@ -134,6 +136,17 @@ class MigrateNodeTest extends MigrateDrupal7TestBase {
     $this->assertIdentical('Some more text', $node->field_text_list[0]->value);
     $this->assertIdentical('7', $node->field_integer_list[0]->value);
     $this->assertIdentical('qwerty', $node->field_text->value);
+    $this->assertIdentical('2', $node->field_file->target_id);
+    $this->assertIdentical('file desc', $node->field_file->description);
+    $this->assertTrue($node->field_file->display);
+    $this->assertIdentical('1', $node->field_images->target_id);
+    $this->assertIdentical('alt text', $node->field_images->alt);
+    $this->assertIdentical('title text', $node->field_images->title);
+    $this->assertIdentical('93', $node->field_images->width);
+    $this->assertIdentical('93', $node->field_images->height);
+
+    $node = Node::load(2);
+    $this->assertIdentical("...is that it's the absolute best show ever. Trust me, I would know.", $node->body->value);
   }
 
 }

core/modules/node/src/Tests/NodeAccessGrantsTest.php

@@ -26,4 +26,13 @@ class NodeAccessGrantsTest extends NodeAccessTest {
    */
   public static $modules = array('node_access_test_empty');
 
+  /**
+   * Test operations not supported by node grants.
+   */
+  function testUnsupportedOperation() {
+    $web_user = $this->drupalCreateUser(['access content']);
+    $node = $this->drupalCreateNode();
+    $this->assertNodeAccess(['random_operation' => FALSE], $node, $web_user);
+  }
+
 }