n8n Remote Code Execution Vulnerability (CVE-2026-85168) — High Severity

Understanding the n8n Remote Code Execution Vulnerability

A serious security flaw, identified as CVE-2026-85168, has been discovered in n8n, a popular workflow automation platform. This vulnerability allows for remote code execution (RCE) within the Git node component of n8n. In simpler terms, an attacker could potentially run their own harmful code on systems running vulnerable versions of n8n, taking advantage of how the Git node handles certain configuration settings.

Specifically, the Git node in n8n did not properly reset all configuration keys that could be used to execute commands. If a specially crafted Git repository included local configuration settings for “content-filter” or “merge-driver” key families, along with a matching attribute pattern, Git would execute a configured command during common operations like adding, committing, checking out, or pulling changes. This malicious command would run with the same permissions as the n8n process user, which could lead to significant system compromise.

CVE Details

• Product: n8n
• Published: September 3, 2026
• Severity: High
• Status: Analyzed

Affected Products

This vulnerability impacts n8n versions prior to:

• 1.123.73
• 2.35.4
• 2.36.2

Current Status

The good news is that patches are available to address this critical vulnerability. It is strongly recommended to update your n8n instances as soon as possible.

Severity Level

The CVE-2026-85168 vulnerability carries a High severity rating with a CVSS score of 8.8. The ability for an attacker to execute arbitrary code remotely on the system makes this a very dangerous flaw. This means successful exploitation could lead to full control over the compromised n8n instance and potentially the underlying server, allowing for data theft, system disruption, or further network infiltration.

Possible Solutions

To protect your n8n installations from this remote code execution vulnerability, you should take immediate action:

Upgrade to Patched Versions:

The most effective solution is to upgrade your n8n instance to one of the following patched versions or newer:

• n8n version 1.123.73 or later
• n8n version 2.35.4 or later
• n8n version 2.36.2 or later

Temporary Workarounds (if immediate upgrade is not possible):

While these do not fully eliminate the risk, they can help mitigate it in the short term:

• Restrict User Access: Limit access to your n8n instance only to users who are fully trusted.
• Disable the Git Node: Add n8n-nodes-base.git to the NODES_EXCLUDE environment variable to disable the vulnerable Git node.
• Run with Low Privileges: Ensure that the n8n process runs under a dedicated user account with the lowest possible privileges. This will limit the damage an attacker can do if they successfully exploit the vulnerability.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-mwp5-2m32-r54h

https://www.vulncheck.com/advisories/n8n-before-1.123.73-remote-code-execution-via-git-node