CVE-2026-92588 n8n-io CVE debrief

Who should care

n8n users with the Source Control (Environments) feature licensed, enabled, and connected to a remote repository should assess exposure and verify versions. Project admins and users with access to the source control push endpoint should be aware of the potential for cross-project data destruction.

Why it matters

CVE-2026-92588 is a medium-severity vulnerability in the n8n workflow automation platform that allows cross-project data destruction via its source control push endpoint. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. n8n users with this feature should assess exposure, verify versions, and ensure proper configuration to prevent potential data destruction.

• Potential cross-project data destruction via source control push endpoint
• Possible unauthorized deletion of workflows and credentials
• Risk of exploitation requires Source Control (Environments) feature to be licensed, enabled, and connected to a remote repository
• Verification of n8n versions and configurations necessary to ensure mitigation

Technical summary

The n8n workflow automation platform has a vulnerability in its source control push endpoint. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, an authenticated project-scoped user could reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository.

Defensive priority

Medium priority for n8n users with Source Control (Environments) feature licensed, enabled, and connected to a remote repository

Recommended defensive actions

• Assess exposure: Review n8n deployments for Source Control (Environments) feature usage and verify versions are 1.123.76, 2.37.7, or 2.38.2 or later
• Verify inventory: Check n8n project configurations for proper access controls and user permissions
• Monitor for suspicious activity: Track source control push endpoint usage and investigate any unusual file deletion or modification attempts
• Remediate vulnerable versions: Upgrade n8n to a fixed version and ensure proper configuration of Source Control (Environments) feature
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in n8n versions before 1.123.76, 2.37.7, and 2.38.2. The issue is fixed in these versions. The vulnerability allows an authenticated project-scoped user to reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.