CVE-2026-86995: n8n Git Node Configuration Bypass Vulnerability
Summary
CVE-2026-86995: Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. Affects n8n across 3 version ranges.
< 1.123.76
>= 2.0.0, < 2.37.7
>= 2.38.0, < 2.38.2
Fixed in 1.123.76, 2.37.7 or 2.38.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks without coding. It features a visual interface for building workflows and supports numerous integrations. However, a recent vulnerability has been identified in the Git node, which could allow unauthorized access to local Git repositories.
Vulnerability Detail
The vulnerability arises from the Git node's handling of the repository configuration. Specifically, the 'setUpstream' function writes a 'branch.<name>.remote' value into the repository's configuration without proper validation. This oversight allows an authenticated user with workflow-edit permissions to manipulate the remote configuration, potentially pointing it to any local repository accessible by the n8n process. As a result, sensitive data from local repositories could be exposed, leading to unauthorized data access.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.123.761.123.76npm install n8n@1.123.76 -
>= 2.0.0, < 2.37.72.37.7npm install n8n@2.37.7 -
>= 2.38.0, < 2.38.22.38.2npm install n8n@2.38.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following temporary mitigations:
- Restrict access to the n8n instance to trusted users only.
- Disable the Git node by adding 'n8n-nodes-base.git' to the 'NODES_EXCLUDE' environment variable.
- Run the n8n process under a dedicated low-privilege OS user account to limit filesystem access.
Conclusion
The CVE-2026-86995 vulnerability in n8n poses a significant risk by allowing unauthorized access to local Git repositories through improper configuration handling. Users are strongly advised to upgrade to the patched versions to mitigate this risk and consider the provided workarounds if immediate upgrades are not possible.
See every vulnerability recorded for n8n →
FAQ
The vulnerability allows authenticated users to bypass sandbox path restrictions, enabling them to access local Git repositories.
If you are using n8n versions prior to 1.123.76 or 2.37.7, your instance is vulnerable. You can check your version by running 'n8n --version'.
An attacker could gain unauthorized access to sensitive data stored in local Git repositories, leading to data breaches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
