CVE-2026-72767: n8n Git Node RCE Vulnerability

CVE-2026-72767 Overview

CVE-2026-72767 is a remote code execution vulnerability in the n8n workflow automation platform. The flaw resides in the Git node and allows authenticated users with workflow creation rights to execute arbitrary commands as the n8n process user. Attackers stage a crafted local repository that triggers git hooks under default git security settings. Both self-hosted and cloud instances are affected. The issue is tracked under [CWE-78] (OS Command Injection).

Affected versions include n8n releases before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1.

Critical Impact
Authenticated users can achieve remote code execution on the underlying n8n host, compromising workflow secrets, connected integrations, and the process user's environment.

Affected Products

n8n versions before 1.123.67
n8n 2.x versions before 2.31.5
n8n 2.32.x versions before 2.32.1

Discovery Timeline

2026-08-11 - CVE-2026-72767 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72767

Vulnerability Analysis

The vulnerability exists in the Git node component of n8n, a widely used workflow automation platform. The Git node performs repository operations on behalf of workflows, including clone, fetch, and checkout actions. When an authenticated user configures a workflow to operate on a specially crafted local repository, git executes hook scripts embedded in that repository. These hooks run under default git security settings and inherit the privileges of the n8n process user.

An attacker with permission to create and execute workflows can therefore run arbitrary operating system commands on the host. Successful exploitation exposes stored credentials, API tokens, and any secrets accessible to the n8n runtime. The vulnerability applies to both self-hosted deployments and n8n Cloud tenants.

Root Cause

The root cause is unsafe execution of git operations against attacker-controlled repository content. Git hooks located inside .git/hooks/ execute automatically during standard operations unless explicit hardening is applied. The Git node did not sanitize repository contents or restrict hook execution, allowing hook scripts staged by an authenticated user to run as commands on the host. This aligns with [CWE-78], OS Command Injection.

Attack Vector

Exploitation requires network access to the n8n interface and valid credentials that permit workflow creation and execution. The attacker stages a repository containing malicious hook scripts, then invokes a workflow that causes the Git node to operate on that repository. When git triggers the hook, the embedded commands execute as the n8n process user without further validation.

No verified public proof-of-concept code is available. See the GitHub Security Advisory and the VulnCheck Advisory for vendor technical details.

Detection Methods for CVE-2026-72767

Indicators of Compromise

Unexpected child processes spawned by the n8n Node.js process, particularly shells (sh, bash) or interpreters (python, perl) launched from git operations.
Presence of unfamiliar hook files under .git/hooks/ inside repositories accessed by n8n workflows.
Outbound network connections from the n8n host to unknown destinations shortly after Git node executions.
Workflow execution logs referencing Git nodes against repositories hosted on unusual or attacker-controlled URLs.

Detection Strategies

Monitor process trees where the n8n runtime spawns non-git binaries following git clone, git fetch, or git checkout invocations.
Alert on file writes to .git/hooks/ directories on filesystems used by n8n execution.
Review n8n audit logs for newly created workflows containing Git nodes authored by non-administrative users.

Monitoring Recommendations

Enable command-line and process-creation telemetry on hosts running n8n to capture hook execution.
Correlate authentication events with workflow creation and Git node activity to identify low-privileged accounts abusing the feature.
Baseline normal git repository sources used by workflows and flag deviations.

How to Mitigate CVE-2026-72767

Immediate Actions Required

Upgrade to n8n 1.123.67, 2.31.5, or 2.32.1 or later depending on your release channel.
Audit existing workflows that use the Git node and review the repositories they target.
Rotate credentials, API tokens, and secrets accessible to the n8n process if exploitation is suspected.
Restrict workflow creation and execution privileges to trusted operators.

Patch Information

The n8n maintainers released fixed versions 1.123.67, 2.31.5, and 2.32.1. Full remediation details are published in the GitHub Security Advisory GHSA-rcv6-pvrj-4xcg. n8n Cloud tenants are updated by the vendor; self-hosted operators must apply the patched release manually.

Workarounds

Temporarily disable or remove the Git node from available workflow components until patching is complete.
Enforce least-privilege role assignments so only administrators can create or edit workflows.
Run the n8n process under a dedicated low-privilege system account with restricted filesystem and network access.
Isolate the n8n host from sensitive internal services using network segmentation.

bash

# Configuration example: upgrade self-hosted n8n via Docker
docker pull n8nio/n8n:1.123.67
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 \
  -v ~/.n8n:/home/node/.n8n \
  n8nio/n8n:1.123.67