CVE-2026-77084 n8n-io CVE debrief

Who should care

Users and administrators of n8n versions before 1.123.69 and 2.x before 2.33.4 / 2.34.1 should be aware of this high-severity vulnerability and take immediate action to mitigate the risk. This includes identifying affected product deployments, reviewing official advisories and CVE records, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets retested, with the item only closed after evidence is documented. This affects operator, platform, vulnerability-management, and security-team impact, requiring a coordinated defensive response to address the code execution vulnerability in the Git node of n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1. The high-severity nature of this vulnerability demands immediate attention from all relevant stakeholders to prevent potential code execution as the n8n process user. Therefore, it is crucial that all necessary steps are taken promptly to mitigate this risk effectively across the organization, ensuring that all affected systems are identified and remediated without delay. This includes verifying the integrity of repository-local git configuration values and implementing necessary controls to prevent exploitation. By taking these actions, organizations can protect their n8n deployments from potential code execution attacks and maintain the security and integrity of their systems and data. The vulnerability's requirement for a separate file-write vulnerability to plant the malicious value underscores the need for comprehensive security measures, including monitoring for suspicious activity and exception tracking, to detect and respond to potential threats in a timely manner. Overall, a proactive and coordinated approach is essential to addressing this high-severity vulnerability and minimizing its potential impact on affected systems and data. This involves not only immediate remediation efforts but also longer

Technical summary

The Git node in n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability. The vulnerability executes certain repository-local git configuration values without neutralizing them, allowing for code execution as the n8n process user. This requires a separate file-write vulnerability to plant the malicious value. The affected product context indicates that users and administrators of n8n versions before 1.123.69 and 2.x before 2.33.4 / 2.34.1 should be aware of this high-severity vulnerability and take immediate action to mitigate the risk.

Defensive priority

High-priority defensive actions are required to address the code execution vulnerability in the Git node of n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1.

Recommended defensive actions

• Inventory and assess n8n installations for version 1.123.69 or 2.33.4 / 2.34.1 or later
• Implement compensating controls to monitor and restrict Git node operations
• Review and neutralize repository-local git configuration values
• Apply vendor remediation or patches as available
• Monitor for suspicious activity and exception tracking

Evidence notes

The CVE-2026-77084 record indicates a code execution vulnerability in n8n's Git node, which executes certain repository-local git configuration values without neutralizing them. This requires a separate file-write vulnerability to plant the malicious value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.