n8n: n8n Has an Arbitrary File Read via Git Node
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-44790
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
Description quoted from the NVD record.
Who is affected
n8n, a tool for automating tasks by connecting apps and online services into workflows, has this flaw. It affects versions before 1.123.43, 2.22.1 and 2.20.7. The problem is in the push action of the Git building block, which sends changes to a code storage service. A logged-in user who is allowed to create or edit workflows could slip extra command options into that action and read any file on the server running n8n. This could lead to a full takeover of that server. This flaw is rated High.
What to do
- If you or someone on your staff installed and runs n8n, that person should update it to version
1.123.43,2.22.1or2.20.7, whichever matches the version series you use, or any later version. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- After the update, the person who manages n8n should check the version number it shows to make sure the update worked.
- If you are not sure whether your organization uses n8n, ask whoever looks after your computers and online services to check.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.