n8n Remote Code Execution Vulnerability (CVE-2026-72767) — High Severity

Overview

A critical security flaw has been identified in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-72767, allows authenticated users to execute unauthorized code on the n8n server. An attacker with privileges to create and execute workflows can exploit a weakness in the Git node by setting up a specially crafted local repository. This action tricks git into running malicious scripts (hooks), which then execute arbitrary commands under the same user permissions as the n8n process. This serious issue impacts both self-hosted and cloud-based n8n installations.

CVE Details

  • Product: n8n
  • Published Date: August 11, 2026
  • Severity: High
  • Status: Analyzed

Affected Products

This vulnerability affects specific versions of n8n:

  • n8n versions before 1.123.67
  • n8n 2.x versions before 2.31.5
  • n8n 2.32.x versions before 2.32.1

Current Status

The vulnerability has been thoroughly analyzed and confirmed. Official patches have been released to address this issue.

Severity Level

CVE-2026-72767 is classified as a HIGH severity vulnerability, with a CVSS score of 8.8. This high rating highlights the significant danger it poses. The exploit does not require complex steps or user interaction beyond the initial authentication and workflow creation. An attacker leveraging this flaw can gain extensive control over the system, impacting the confidentiality, integrity, and availability of your n8n instance and potentially the underlying host.

Possible Solutions

To safeguard your n8n environment, it is crucial to apply the available patches without delay:

  • If you are running n8n 1.x, upgrade to version 1.123.67 or any later release.
  • For n8n 2.x users, upgrade to version 2.31.5 or a newer version within the 2.x branch.
  • If you are using n8n 2.32.x, upgrade to version 2.32.1 or a subsequent release.

Should an immediate upgrade not be feasible, the following temporary mitigation steps can help reduce the risk, but they do not provide full protection:

  • Restrict User Access: Ensure that only fully trusted users have access to create and execute workflows on your n8n instance.
  • Disable the Git Node: Add n8n-nodes-base.git to the NODES_EXCLUDE environment variable in your n8n configuration. This will prevent the vulnerable Git node from being used.
  • Implement Network Egress Restrictions: Configure your network to limit or prevent outbound connections from the n8n instance. This can help contain the impact if an attacker manages to execute arbitrary code.

These workarounds are interim solutions. Prioritize applying the official updates as soon as possible for comprehensive protection.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-rcv6-pvrj-4xcg
https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-node

Tags
Alex Joseph
Alex Joseph

Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.

Related Posts