Executive brief
n8n is a workflow automation platform that includes a Git node for performing git operations like fetch and pull. A flaw in the Git node allows authenticated users with workflow-edit permissions to read the contents of any local Git repository that the n8n process has access to, bypassing intended security restrictions. An attacker with this permission level could extract sensitive data from repositories on the same system.
Technical details
The vulnerability is a path traversal / external control of file name (CWE-22, CWE-73) in the n8n Git node. The setUpstream function writes a branch.<name>.remote value into the git repository configuration without validating it against the same path restrictions applied to the repository parameter. When a subsequent fetch or pull operation occurs, it reads the remote from the unvalidated configuration key rather than the checked parameter, allowing an authenticated attacker to redirect git operations to any readable local repository. This requires workflow-edit permission and network reachability to the n8n instance. The fix validates the branch remote configuration using the same terms as the repository parameter. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Patches released: n8n 1.123.76, 2.37.7, 2.38.2