Is CVE-2026-110845 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110845 being exploited in the wild.

How severe is CVE-2026-110845?

Informational severity, published 14 October 2026.

Which products and versions are affected?

N8n before 1.123.83, 2.x before 2.41.4, 2.42.x before 2.42.1.

How is CVE-2026-110845 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110845?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110845: n8n code execution in Git node Log operation

CVE-2026-110845 · Severity: info · Published 2026-10-14

n8n is a workflow automation platform that allows users to connect applications and automate tasks. The Git node's Log operation fails to neutralize repository configuration before running external programs, allowing authenticated users with control over a repository's configuration to execute arbitrary code on the n8n server with the privileges of the n8n process. This could lead to full system compromise, data theft, or lateral movement within the network.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-110845 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110845 being exploited in the wild.
How severe is CVE-2026-110845?: Informational severity, published 14 October 2026.
Which products and versions are affected?: N8n before 1.123.83, 2.x before 2.41.4, 2.42.x before 2.42.1.
Is there a fix for CVE-2026-110845?: Yes: fixed in n8n 1.123.83, 2.41.4, 2.42.1. Until then: Restrict n8n instance access to fully trusted users only. Audit the file-access root for repositories whose local git configuration contains unexpected program-execution keys and remove or correct them. Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable if it is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110845 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110845?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: n8n 1.123.83, 2.41.4, 2.42.1

Restrict n8n instance access to fully trusted users only. Audit the file-access root for repositories whose local git configuration contains unexpected program-execution keys and remove or correct them. Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable if it is not required.

Technical details

The vulnerability exists in the Git node's Log operation, which fails to strip local git configuration settings before invoking an external program. Git configuration can specify custom programs to execute, and the Log operation never applies the protective stripping that other operations use. An authenticated n8n user with control over a repository's local git configuration (or pointing the node at such a repository) can achieve arbitrary code execution as the n8n process user, including when the node is used as an agent tool.

Affected products

n8n n8n before 1.123.83, 2.x before 2.41.4, 2.42.x before 2.42.1

Timeline

2026-09-30: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.