Compliance Impact

This vulnerability allows an authenticated user to read arbitrary files from the n8n server, potentially leading to full system compromise. Such unauthorized access to sensitive data can result in violations of data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal and health information.

Because the vulnerability impacts confidentiality, integrity, and availability of data, it poses a significant risk to compliance with these standards, which mandate safeguarding sensitive information against unauthorized access and ensuring system security.

Mitigations such as upgrading to fixed versions or restricting permissions are critical to maintaining compliance and reducing the risk of data breaches.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-44790 is a critical vulnerability in n8n, an open-source workflow automation platform. It affects versions prior to 1.123.43, 2.20.7, and 2.22.1.

The vulnerability occurs in the Git node's Push operation, where an authenticated user with permission to create or modify workflows can inject command-line interface (CLI) flags. This injection allows the attacker to read arbitrary files from the n8n server.

This flaw is due to improper neutralization of argument delimiters in command execution, classified as CWE-88.

The vulnerability has been fixed in versions 1.123.43, 2.22.1, and 2.20.7.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including the potential for full system compromise.

An attacker who exploits this vulnerability can read arbitrary files on the n8n server, which may lead to unauthorized access to sensitive data.

The CVSS score of 9.4 (Critical) indicates high impacts on confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user injecting CLI flags on the Git node's Push operation in n8n to read arbitrary files. Detection would focus on monitoring for unusual or unauthorized workflow modifications or suspicious Git node Push operations.

Since the vulnerability requires authenticated access with workflow creation or modification permissions, reviewing audit logs for unexpected workflow changes or Git node usage may help detect exploitation attempts.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade n8n to version 1.123.43, 2.22.1, or 2.20.7 or later, where the vulnerability is fixed.

• Restrict workflow creation and modification permissions to trusted users only.
• Temporarily disable the Git node entirely to prevent exploitation via the Push operation.

Useful 0 Not Useful 0