Understanding the n8n Path Traversal Vulnerability
A significant security flaw has been found in n8n, an open-source platform that helps automate workflows. This vulnerability, identified as CVE-2026-49465, could allow an unauthorized user to access sensitive files on the system. It is considered a high-severity issue because it could lead to the theft of confidential information.
CVE Details
Product Name: n8n
Published Date: June 23, 2026
Severity: High
Status: Analyzed
Affected Products
This vulnerability impacts versions of n8n prior to the following:
- 1.123.48
- 2.21.8
- 2.22.4
Specifically, the issue resides within the Git node’s “Clone” and “Push” operations. An authenticated user, who has been granted permission to create or change workflows, could use a local file path in these operations. This action bypasses the file sandbox, a security measure designed to restrict file access, allowing them to read the contents of any local Git repository that the n8n process can access.
Current Status
The vulnerability status is “Analyzed.” This means that the details of the flaw have been thoroughly investigated and confirmed by security experts.
Severity Level
The severity of CVE-2026-49465 is rated as High with a CVSS score of 7.7. This high rating indicates that exploiting this vulnerability could have a serious impact, primarily on the confidentiality of data stored on the affected system.
Possible Solutions
The good news is that fixes are available for this vulnerability. Users are strongly advised to upgrade their n8n installations to one of the following patched versions or later:
- n8n version 1.123.48
- n8n version 2.21.8
- n8n version 2.22.4
If an immediate upgrade is not feasible, there are some temporary workarounds:
- Restrict permissions for creating and editing workflows to only trusted users.
- Disable the Git node entirely by adding
n8n-nodes-base.gitto theNODES_EXCLUDEenvironment variable in your n8n setup.
Please note that these workarounds offer only partial protection and should be considered short-term measures until a full upgrade can be performed.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-5xp3-2w67-427v
