Executive Summary

CVE-2026-49465 is a vulnerability in n8n, an open-source workflow automation platform. It allows an authenticated user who has permission to create or modify workflows to bypass file sandbox restrictions by supplying a local filesystem path as the source repository in the Git node's Clone operation or as the target repository in the Push operation.

This bypass lets the user read the contents of any local Git repository accessible to the n8n process, circumventing the N8N_RESTRICT_FILE_ACCESS_TO sandbox that normally blocks direct file reads to restricted paths.

The vulnerability affects n8n versions prior to 1.123.48, 2.21.8, and 2.22.4, and has been fixed in these versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with workflow creation or modification permissions to read sensitive data stored in any local Git repository accessible to the n8n process.

Since the vulnerability bypasses file access restrictions, it can lead to unauthorized disclosure of confidential information.

The CVSS score is 6.0 (Moderate), indicating a significant impact on confidentiality, but no impact on integrity or availability.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying whether an authenticated user with workflow creation or modification permissions is supplying local filesystem paths in the Git node's Clone or Push operations to bypass sandbox restrictions.

Since the vulnerability exploits the use of local filesystem paths in Git node operations, monitoring logs for unusual Git clone or push commands referencing local paths could help detect exploitation attempts.

There are no specific commands provided in the available resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading n8n to versions 1.123.48, 2.21.8, or 2.22.4 where the vulnerability is fixed.

As a temporary measure before upgrading, restrict workflow creation and modification permissions to trusted users only.

Alternatively, disable the Git node entirely to prevent exploitation of this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with certain permissions to bypass file sandbox restrictions and read the contents of any local Git repository accessible to the n8n process. This results in a high impact on confidentiality.

Since confidentiality of data is a critical aspect of compliance with standards like GDPR and HIPAA, this vulnerability could lead to unauthorized access to sensitive information, potentially causing non-compliance with these regulations.

Mitigations such as upgrading to patched versions or restricting workflow permissions are necessary to maintain compliance and protect sensitive data.

Useful 0 Not Useful 0