PatchSiren cyber security CVE debrief
CVE-2026-65598 n8n-io CVE debrief
CVE-2026-65598 is a high-severity vulnerability in n8n, a workflow automation tool. It allows authenticated users to bypass path restrictions and execute JavaScript on the server by exploiting a time-of-check-to-time-of-use (TOCTOU) race condition in the Git node's clone operation. This vulnerability affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. The vulnerability has a CVSS score of 8.9 and is classified as HIGH severity. The CVE record and NVD entry provide additional context on the vulnerability.
- Vendor
- n8n-io
- Product
- n8n
- CVSS
- HIGH 8.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-22
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-22
- Advisory updated
- 2026-07-22
Who should care
Users of n8n versions before 1.123.64, 2.29.8, and 2.30.1 should apply patches immediately to prevent exploitation. This includes administrators and users of self-hosted and cloud instances of n8n. The vulnerability can be mitigated by applying patches, restricting access to the community node directory, and monitoring for suspicious activity in n8n logs.
Technical summary
The vulnerability exists in the Git node's clone operation in n8n. An attacker can exploit this TOCTOU race condition by swapping a directory for a symlink after the path is validated but before the clone runs. This allows the attacker to plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. The vulnerability is caused by a race condition between the validation of the path and the clone operation. This vulnerability can be exploited by authenticated users.
Defensive priority
High
Recommended defensive actions
- Apply patches to upgrade n8n to version 1.123.64, 2.29.8, or 2.30.1
- Restrict access to the community node directory
- Monitor for suspicious activity in n8n logs
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The CVE record was published on 2026-07-22T12:18:20.037Z and last modified on 2026-07-22T16:27:18.220Z. The NVD entry is currently Undergoing Analysis. This information is based on the supplied source corpus. Defenders should verify the accuracy of this information with the official CVE record and NVD entry. The CVE record and NVD entry may provide additional details on the vulnerability, such as affected products, versions, and potential mitigations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T12:18:20.037Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.