CVE-2026-86995

Analyzed Analyzed - Analysis Complete

Git Remote Misconfiguration in n8n Workflow Automation

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86995

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.38.0 (inc) to 2.38.2 (exc)
n8n	n8n	to 1.123.76 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.37.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects the n8n workflow automation platform. It allows an authenticated user with workflow-edit permissions to manipulate Git operations by pointing the remote repository to any local repository accessible by the n8n process. This could lead to unauthorized reading of local Git repository contents. The issue is due to improper validation in the Git node's setUpstream function, which writes unvalidated remote branch values into repository configuration.

Detection Guidance

Check the version of n8n installed on your system. If it is prior to 1.123.76, 2.37.7, or 2.38.2, the system is vulnerable. Run commands like 'n8n --version' or check the package manager for installed versions.

Impact Analysis

An attacker with workflow-edit access could read sensitive files from local Git repositories accessible by the n8n process. This could expose confidential data, source code, or other sensitive information stored in those repositories. The impact depends on the contents of the local repositories and the permissions of the n8n process.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Exposure of personal or health data could result in regulatory penalties, reputational damage, and legal consequences depending on the jurisdiction and data involved.

Mitigation Strategies

Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later. Alternatively, restrict access to trusted users, disable the Git node, or run n8n under a low-privilege OS user account.

Hi! I’m here to help you understand CVE-2026-86995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70