CVE-2026-72767 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, workflow configurations, and user management should assess exposure and prioritize patching to mitigate potential exploitation. This includes verifying n8n instance exposure and workflow configurations, assessing user rights and Git node usage, and applying patches to affected versions.

Why it matters

CVE-2026-72767 is a remote code execution vulnerability in n8n's Git node, affecting authenticated users with workflow creation and execution rights. Defenders should prioritize verifying exposure, assessing workflow configurations, and applying vendor patches to mitigate potential exploitation.

• Potential execution of arbitrary commands as the n8n process user
• Exposure of self-hosted and cloud instances to authenticated users
• Verification of workflow configurations and user rights required
• Patching necessary to prevent exploitation

Technical summary

The vulnerability exists in n8n's Git node, allowing authenticated users with rights to create and execute workflows to stage a crafted local repository. This causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Affected versions include n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. The vulnerability has significant implications for defenders, as it can lead to potential execution of arbitrary commands as the n8n process user, exposure of self-hosted and cloud instances to authenticated users, and verification of workflow configurations and user rights required.

Defensive priority

Defenders should prioritize verifying exposure, assessing workflow configurations, and applying vendor patches to mitigate potential exploitation.

Recommended defensive actions

• Verify n8n instance exposure and workflow configurations
• Assess user rights and Git node usage
• Apply patches to affected versions (n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1)
• Monitor for suspicious workflow activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and references to vendor advisories. The vulnerability exists in n8n's Git node, allowing authenticated users with rights to create and execute workflows to stage a crafted local repository. This causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Affected versions include n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1. The CVE Program record and NVD entry provide source

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.