# CVE-2026-65598: n8n TOCTOU race condition in Git node clone operation

Source: https://junglewise.ai/threats/cve-2026-65598-n8n-toctou-race-condition-in-git-node-clone-operation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-65598 · Severity: high · CVSS 4 · Published 2026-07-22

n8n is a popular workflow automation tool used to connect different software services. A security flaw in its Git integration allows an authorized user to bypass security restrictions and run malicious code on the server hosting the application. This could lead to a full system takeover, data theft, or disruption of automated business processes.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n), [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-65598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65598 being exploited in the wild.

**How severe is CVE-2026-65598?** High severity, with a CVSS score of 4, published 22 July 2026.

**Which products and versions are affected?** N8n < 1.123.64, < 2.29.8, < 2.30.1, < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1; n8n (npm) SEMVER:introduced=0,fixed=1.123.64.

**Is there a fix for CVE-2026-65598?** Yes. n8n (npm): upgrade to 1.123.64 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65598 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65598?** Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n (npm): upgrade to 1.123.64 or later

  ```sh
  npm install n8n@1.123.64
  ```


## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Git node's 'clone' operation. An authenticated attacker can bypass path validation by replacing a legitimate directory with a symbolic link after the path has been verified but before the git clone execution begins. This allows the attacker to write a malicious repository into the community node directory. Upon the next system restart, n8n loads the malicious repository as a custom node, executing arbitrary JavaScript in the context of the server. The vulnerability affects both self-hosted and cloud instances where users have permission to create workflows using the Git node. Patches are available in versions 1.123.64, 2.29.8, and 2.30.1.

## Affected products

- n8n-io n8n < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1

## Identifiers

- CVE-2026-65598
- GHSA-g3r5-9h93-4j2c

## Timeline

- 2026-07-08: disclosed: Initial disclosure by researcher
- 2026-07-22: advisory: GitHub Advisory published

## References

- [https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c](https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64](https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8](https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1](https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1)
- [https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone](https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)