Alex Joseph
A serious security flaw has been discovered in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-65598, is a race condition in the software’s Git node that could allow an authenticated attacker to execute malicious code on the server. This means an unauthorized user could potentially take full control of your n8n instance, whether it’s hosted on your own servers or in the cloud.
The core of the problem lies in how n8n handles Git clone operations. A clever attacker can trick the system by quickly replacing a legitimate directory with a symbolic link. This happens between the time n8n checks the file path and the moment it actually performs the clone. By doing this, the attacker can plant a specially crafted repository in a critical system directory. When n8n restarts, it loads this malicious repository as a custom node, which then executes harmful JavaScript code on the server, leading to a complete compromise of the system.
CVE Details
- Product: n8n
- Published: July 22, 2026
- Severity: High (CVSS v4.0 Score: 8.9)
- Status: Analyzed
Affected Products
The vulnerability impacts various versions of n8n, specifically:
- All n8n versions prior to 1.123.64
- All n8n versions prior to 2.29.8
- All n8n versions prior to 2.30.1 (including version 2.30.0)
Both community and enterprise editions of n8n are vulnerable if they utilize these affected versions and allow authenticated users to create and run workflows that use the Git node.
Current Status
This vulnerability has been thoroughly analyzed, and the details have been publicly disclosed. This means that while the problem is understood, active steps are necessary for users to protect their systems.
Severity Level
The vulnerability is rated as High severity with a CVSS v4.0 score of 8.9. This high score reflects the significant risk posed by the flaw. An attacker only needs low privileges and no user interaction is required beyond the initial authentication to exploit this. A successful attack can lead to high impact on confidentiality, integrity, and availability of the vulnerable system, as well as high confidentiality and low integrity/availability impact on subsequent systems. Essentially, this means an attacker could steal sensitive data, tamper with your workflows, or make your n8n service unavailable, with potential knock-on effects on other connected systems.
Possible Solutions
To secure your n8n instances, immediate action is highly recommended:
Patches and Upgrades:
The most effective solution is to update your n8n installation to a patched version. Users should upgrade to:
- n8n version 1.123.64 or later
- n8n version 2.29.8 or later
- n8n version 2.30.1 or later
These updated versions contain the necessary fixes to address the race condition in the Git node.
Workarounds (Temporary Mitigations):
If an immediate upgrade is not feasible, consider implementing these temporary mitigation steps:
- Restrict User Access: Limit access to your n8n instance to only fully trusted users. This reduces the pool of potential attackers who could exploit this flaw.
- Disable the Git Node: You can disable the vulnerable Git node by setting the environment variable
NODES_EXCLUDEto includen8n-nodes-base.git. This prevents the Git node from being used in workflows. - Restrict Network Egress: Implement network rules to prevent your n8n instance from making outbound connections to untrusted or attacker-controlled Git repositories.
Remember, these workarounds offer partial protection and should only be used as a short-term measure until you can apply the official patches.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c
https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone
