CVE-2026-72770 n8n-io CVE debrief

Who should care

Users of n8n versions before 1.123.67, especially those with workflow create/execute rights, should be aware of this vulnerability and take steps to mitigate it. Additionally, security teams and vulnerability management teams should review their deployments and configurations to ensure they are not exposed to this vulnerability. Operators and platform administrators should also be aware of the potential impact of this vulnerability on their systems.

Technical summary

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations. Authenticated users with workflow create/execute rights can exploit this vulnerability to bypass repository-path containment checks and read arbitrary git repositories. This vulnerability allows attackers to access sensitive information and potentially lead to further exploitation.

Defensive priority

Authenticated users with workflow create/execute rights can exploit this vulnerability; prioritize patching for exposed systems.

Recommended defensive actions

• Patch n8n to version 1.123.67 or later
• Restrict workflow create/execute rights to trusted users
• Monitor Git node operations for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official sources indicates a path traversal vulnerability in n8n versions before 1.123.67; verify affected versions and configurations. Additional evidence suggests that authenticated users with workflow create/execute rights can exploit this vulnerability to bypass repository-path containment checks and read arbitrary git repositories. Users should verify their deployments and configurations to ensure they are not exposed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.