CVE-2026-86995 Overview
CVE-2026-86995 is a path traversal vulnerability [CWE-22] in n8n, an open source workflow automation platform. The Git node validates the repository parameter for fetch and pull operations, but setUpstream writes a branch..remote value into the repository configuration without validation. A subsequent fetch or pull resolves the remote from that stored configuration rather than the checked parameter. An authenticated workflow editor can point Git at any local repository readable by the n8n process and exfiltrate its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. The issue affects versions prior to 1.123.76, 2.37.7, and 2.38.2.
Critical Impact
Authenticated workflow editors can read arbitrary local Git repositories accessible to the n8n process, exposing source code and secrets stored in adjacent repositories.
Affected Products
- n8n versions prior to 1.123.76
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2
Discovery Timeline
- 2026-09-08 - CVE-2026-86995 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86995
Vulnerability Analysis
The n8n Git node exposes several Git operations to workflow editors, including clone, fetch, pull, and setUpstream. Input validation for the repository parameter is applied inconsistently across these operations. The fetch and pull handlers validate the supplied repository argument, but the setUpstream operation writes an attacker-controlled value directly into the local Git configuration under branch..remote.
On subsequent fetch or pull invocations, Git resolves the remote URL from the persisted configuration instead of the parameter that was validated at call time. This time-of-check to time-of-use gap allows an authenticated user to bypass the intended repository allow-listing and coerce the n8n process into interacting with any local repository path readable by its user.
The vulnerability is scoped to authenticated workflow editors and exposes confidentiality of local filesystem resources reachable by the n8n runtime, including source code, commit history, and secrets stored in adjacent Git repositories.
Root Cause
The root cause is missing validation of the remote value in the setUpstream code path within packages/nodes-base/nodes/Git/GenericFunctions.ts. Validation applied to the repository parameter does not extend to persisted Git configuration values consulted by later operations.
Attack Vector
Exploitation requires an authenticated user with workflow edit privileges. The attacker configures a Git node to invoke setUpstream with a branch..remote value pointing to a local filesystem path. A follow-up fetch or pull node then reads the repository at that path and returns its contents through the workflow, enabling data exfiltration. Refer to the GitHub Security Advisory GHSA-qgpw-8g46-w95v for the maintainer's technical description.
Detection Methods for CVE-2026-86995
Indicators of Compromise
- Git node executions using the setUpstream operation with remote values that reference local filesystem paths rather than remote URLs.
- Unexpected fetch or pull activity from the n8n process against directories outside the intended workflow repository root.
- Workflow execution logs showing repeated Git operations targeting the same non-remote path.
Detection Strategies
- Audit n8n workflow definitions for Git nodes that combine setUpstream with subsequent fetch or pull steps.
- Correlate n8n audit logs with filesystem access events on the host to identify Git reads outside expected project directories.
- Review process telemetry for git child processes spawned by the n8n service that reference paths under /home, /root, or other sensitive locations.
Monitoring Recommendations
- Enable and centralize n8n execution logs, including node parameters, to a log analytics platform for review.
- Monitor the n8n service account for reads of Git repositories not owned by the workflow tenant.
- Alert on modifications to .git/config files in directories accessed by the n8n runtime.
How to Mitigate CVE-2026-86995
Immediate Actions Required
- Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 or later based on your release branch.
- Review existing workflows that use the Git node and remove or restrict any that invoke setUpstream.
- Rotate credentials and secrets that may have been exposed through Git repositories readable by the n8n process.
Patch Information
The issue is fixed in n8n releases 1.123.76, 2.37.7, and 2.38.2. The fixes extend validation to the remote value written by setUpstream so that persisted configuration cannot bypass the checks applied to the repository parameter.
Workarounds
- Restrict workflow editor privileges to trusted operators until the upgrade is applied.
- Run the n8n process under a dedicated, least-privileged user account with no read access to unrelated Git repositories on the host.
- Isolate n8n in a container or dedicated host to limit the filesystem scope reachable via the Git node.
- Disable or block the Git node in tenant environments where it is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
