PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92587 n8n-io CVE debrief

CVE-2026-92587 is a vulnerability in the n8n workflow automation platform that allows an authenticated user to access and merge objects from a Git repository outside the configured sandbox. The issue arises from the Git node's validation of relative remote URLs against the repository path, which can be exploited by nesting the repository one level below the configured path. This vulnerability has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2.

Vendor
n8n-io
Product
n8n
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-09-22
Advisory published
2026-09-16
Advisory updated
2026-09-22

Who should care

Defenders responsible for n8n installations, particularly those with exposed or internet-facing deployments, should assess their exposure and prioritize patching to prevent potential sandbox escapes.

Why it matters

CVE-2026-92587 allows authenticated users to escape the sandbox in n8n workflow automation platforms, potentially leading to unauthorized access and data breaches. Defenders should verify their installations, apply patches, and restrict access to the Git node to mitigate this vulnerability.

  • Authenticated users could access and merge objects from external Git repositories.
  • Potential for reading sensitive data from external repositories.
  • Possible disruption of n8n workflows due to unauthorized repository access.
  • Verification of n8n installations and patches is required to prevent exploitation.

Technical summary

The Git node in n8n validates a relative remote URL against the configured repositoryPath but then invokes git with that path as its working directory. An authenticated user can nest the repository one level below the configured path to make an identical URL string pass the file-access check while git resolves it outside the sandbox. A subsequent fetch or pull reads a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merges its objects into the user's own repository.

Defensive priority

Defenders should prioritize verifying their n8n installations and applying the available patches to prevent potential sandbox escapes.

Recommended defensive actions

  • Verify n8n installations and apply patches to prevent potential sandbox escapes.
  • Restrict access to the Git node and monitor for suspicious activity.
  • Implement compensating controls to limit the impact of a potential exploit.
  • Review n8n workflow configurations to ensure proper sandboxing.
  • Conduct regular security audits to detect potential vulnerabilities.
  • Monitor for unusual activity in n8n workflows.
  • Keep n8n and its components up-to-date with the latest security patches.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed versions. However, the exact scope of affected deployments and the number of potential victims are unknown.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92587 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92587

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92587 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92587

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.