A critical security flaw has been identified in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-72767, allows authenticated users to execute unauthorized code on the n8n server. An attacker with privileges to create and execute workflows can exploit a weakness in the Git node by setting up a specially crafted local repository. This action tricks This vulnerability affects specific versions of n8n:<\/p>\n The vulnerability has been thoroughly analyzed and confirmed. Official patches have been released to address this issue.<\/p>\n CVE-2026-72767 is classified as a HIGH severity vulnerability, with a CVSS score of 8.8. This high rating highlights the significant danger it poses. The exploit does not require complex steps or user interaction beyond the initial authentication and workflow creation. An attacker leveraging this flaw can gain extensive control over the system, impacting the confidentiality, integrity, and availability of your n8n instance and potentially the underlying host.<\/p>\n To safeguard your n8n environment, it is crucial to apply the available patches without delay:<\/p>\n Should an immediate upgrade not be feasible, the following temporary mitigation steps can help reduce the risk, but they do not provide full protection:<\/p>\n These workarounds are interim solutions. Prioritize applying the official updates as soon as possible for comprehensive protection.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-rcv6-pvrj-4xcg Overview A critical security flaw has been identified in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-72767, allows authenticated users to execute unauthorized code on the n8n server. An attacker with privileges to create and execute workflows can exploit a weakness in the Git node by setting up a specially crafted local […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[732,1067,887,757,1068],"class_list":["post-4043","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cybersecurity","tag-n8n","tag-rce","tag-remote-code-execution","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\ngit<\/code> into running malicious scripts (hooks), which then execute arbitrary commands under the same user permissions as the n8n process. This serious issue impacts both self-hosted and cloud-based n8n installations.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
n8n-nodes-base.git<\/code> to the NODES_EXCLUDE<\/code> environment variable in your n8n configuration. This will prevent the vulnerable Git node from being used.<\/li>\nReferences<\/h2>\n
\nhttps:\/\/www.vulncheck.com\/advisories\/n8n-before-remote-code-execution-via-git-node<\/p>\n","protected":false},"excerpt":{"rendered":"