CVE-2026-92588: n8n Privilege Escalation Vulnerability

CVE-2026-92588 Overview

CVE-2026-92588 is an improper authorization vulnerability [CWE-639] in the n8n workflow automation platform. The flaw exists in the source control push endpoint, which trusts file paths and status information supplied in the client request payload rather than recomputing them server-side for the requesting user. An authenticated project-scoped user, such as a project admin, can reference workflows and credentials belonging to projects they do not have access to and push deletions for them. Successful exploitation results in cross-project data destruction across the n8n instance.

Critical Impact
Authenticated project admins can delete workflows and credentials in projects they have no legitimate access to, causing cross-tenant data loss.

Affected Products

n8n versions prior to 1.123.76
n8n versions prior to 2.37.7
n8n versions prior to 2.38.2 (with the Source Control / Environments enterprise feature enabled)

Discovery Timeline

2026-09-16 - CVE-2026-92588 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92588

Vulnerability Analysis

n8n's Source Control feature synchronizes workflows and credentials between an n8n instance and a remote Git repository. The push endpoint accepts a payload describing which files should be committed and their status (added, modified, deleted). In vulnerable releases, the server used this client-supplied file list directly to construct the push operation.

Because the server did not recompute the authoritative set of changed files against the requesting user's authorization scope, a project-scoped user could enumerate identifiers for workflows and credentials belonging to other projects and include them in the push payload as deletions. The commit is then applied to the shared source-controlled state, propagating destructive changes across project boundaries.

The vulnerability falls under [CWE-639: Authorization Bypass Through User-Controlled Key]. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository.

Root Cause

The root cause is reliance on client-supplied state instead of server-side authorization. The push handler trusted the files array from the request body as the source of truth for what to commit, without validating that each referenced resource belonged to a project the caller was authorized to modify.

Attack Vector

An authenticated user with project admin privileges on any project sends a crafted push request to the source control endpoint. The request references workflow and credential file paths from unrelated projects and marks them for deletion. The server commits and pushes the deletion, removing the target resources from the connected repository and from the n8n instance state that mirrors it.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-hvrx-jc5j-pg3w for vendor detail.

Detection Methods for CVE-2026-92588

Indicators of Compromise

Unexpected deletion commits in the connected source control repository referencing workflows or credentials outside the committing user's project scope.
Audit log entries showing source control push actions initiated by project admins that affect resources in projects they do not own.
Sudden disappearance of workflows or credentials in projects whose owners did not initiate any source control action.

Detection Strategies

Review n8n audit logs for source control push events and correlate the referenced resource IDs with the acting user's project membership.
Inspect the Git history of the connected repository for bulk deletions of workflow JSON files or credential references committed by non-owning users.
Alert on any push where the count of deleted resources exceeds a defined baseline for a single user session.

Monitoring Recommendations

Enable and centralize n8n audit logging, forwarding events to a SIEM for cross-user correlation.
Monitor the Git remote for force-pushes, mass deletions, and commits authored by service accounts tied to n8n source control.
Track project admin role assignments and review high-privilege activity on a recurring basis.

How to Mitigate CVE-2026-92588

Immediate Actions Required

Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later, depending on your release branch.
If upgrade is not immediately possible, disable the Source Control (Environments) feature or disconnect the remote repository until patched.
Audit recent source control push events and Git history for unauthorized deletions and restore affected workflows and credentials from backups.

Patch Information

The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2. The patched releases compute the set of files to push from the server-side status scoped to the requesting user, ignoring untrusted path and status data in the request payload. See the GitHub Security Advisory and the VulnCheck advisory for full details.

Workarounds

Disable the Source Control (Environments) enterprise feature until the patched version is deployed.
Restrict project admin role assignments to a minimal set of trusted operators and remove standing access where feasible.
Configure the Git remote with branch protection rules that require review before destructive changes are merged into production branches.

bash

# Verify installed n8n version and upgrade to a patched release
n8n --version
npm install -g n8n@1.123.76   # or 2.37.7 / 2.38.2 per your release branch