CVE-2026-110845 n8n-io CVE debrief

Who should care

Defenders managing n8n instances, especially those with multiple authenticated members or integrations with repository control, should assess exposure and apply patches. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify n8n version and exposure, and apply patches to prevent code execution as the n8n process user. They should also monitor n8n instances for suspicious activity and restrict

Why it matters

Authenticated members with control over a repository can execute programs as the n8n process user via the Git node Log operation in n8n before 1.123.83, 2.41.4, and 2.42.1, requiring defenders to verify exposure and apply patches.

• Code execution as the n8n process user
• Potential for lateral movement within the network
• Need for verification of n8n version and exposure
• Priority for patching and monitoring

Technical summary

The n8n workflow automation tool contains a code execution vulnerability in the Git node Log operation. Authenticated members who can point the node at a repository they control can execute programs as the n8n process user. This vulnerability is due to the failure of the Git node to strip a repository's local git configuration before invoking an external program. The vulnerability affects n8n versions before 1.123.83, 2.41.4, and 2.42.1. Defenders should prioritize verifying exposure and applying patches for n8n instances, especially those with authenticated members who can control repositories.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for n8n instances, especially those with authenticated members who can control repositories.

Recommended defensive actions

• Verify n8n version and apply patches to ensure 1.123.83, 2.41.4, or 2.42.1 or later is used
• Restrict repository control to trusted members
• Monitor n8n instances for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in n8n before 1.123.83, 2.41.4, and 2.42.1. The GitHub Security Advisory (GHSA-x8wx-g24x-3549) and VulnCheck Advisory offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.