n8n: N8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-72767
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating everyday tasks by linking apps and services together in workflows. This flaw affects versions before 1.123.67, 2.x versions before 2.31.5, and 2.32.x versions before 2.32.1, both on your own servers and in n8n's cloud service. The problem is in the building block that lets a workflow work with Git, a tool for tracking changes to files. A signed-in user who is allowed to create and run workflows could set up a specially prepared folder that makes n8n run any commands they choose on the computer running it. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should check which version is in use.
- If you run n8n on your own server, update it right away. If you are on version 1, move to
1.123.67or later. If you are on 2.x before 2.32, move to2.31.5. If you are on 2.32.x, move to2.32.1or later. - If an IT provider or n8n's cloud service runs n8n for you, send them this advisory and ask when the update will be done.
- If you cannot tell which version you have, check the vendor advisory linked on this page for the fixed releases and how to update.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.