CVE-2026-72767
Received Received - Intake

Remote Code Execution in n8n Workflow Automation

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72767
EUVD
EUVD-2026-56093

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.67 (exc)
n8n n8n From 2.31.5 (inc) to 2.32.1 (exc)
n8n n8n From 2.32.0 (inc) to 2.32.1 (exc)
n8n n8n to 2.31.5 (exc)
n8n n8n to 2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72767 is a remote code execution vulnerability in n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. It affects the Git node, allowing authenticated users with workflow creation rights to execute arbitrary commands on the n8n host system by staging a malicious local repository that triggers Git hooks.

Detection Guidance

Check n8n version with 'n8n --version' or 'docker exec <container> n8n --version'. If running versions before 1.123.67, 2.31.5, or 2.32.1, the system is vulnerable. Review workflows using the Git node for suspicious local repository configurations.

Impact Analysis

An attacker could gain control of the n8n process user account, potentially leading to unauthorized access, data theft, or system compromise. Both self-hosted and cloud instances are affected if authenticated users can create workflows using the Git node.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if sensitive data is exposed or altered due to the remote code execution.

Mitigation Strategies

Update n8n to versions 1.123.67, 2.31.5, or 2.32.1 or later. Restrict instance access to trusted users only. Disable the Git node if not required. Limit network egress to prevent command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart