AI Threat AlertCVE-2026-110845: n8n: Git node Log op enables code execution
HIGHn8n's Git node Log operation fails to strip a repository's local git configuration before invoking an external program (CWE-15, external control of configuration), so an authenticated member who controls a repository's local config can run arbitrary programs as the n8n process user, including when the node is exposed as an agent tool. No CVSS, EPSS, KEV or SSVC data exists yet, no public exploit or Nuclei template is known, and the vendor advisory (GHSA-x8wx-g24x-3549) plus VulnCheck are the only sources, so urgency rests on impact rather than measured exploitation. The impact is high for multi-tenant or shared n8n instances: any low-privilege member can pivot to the host, where workflow credentials, API keys and LLM provider secrets are typically stored. Upgrade to 1.123.83, 2.41.4 or 2.42.1 (or later), and until then restrict who can create or edit workflows that use the Git node and remove it from agent tool sets.
What is the risk?
Severity is not yet scored. The attack requires authentication as a member with workflow editing rights and the ability to point the Git node at an attacker-controlled repository, so exposure is limited to insiders, compromised accounts, or prompt-injected agents. Impact is high because code execution runs as the n8n process user and can reach every stored credential. Likelihood is moderate: the technique (malicious git config such as core.fsmonitor or pager settings) is well understood, no exploit is public, and the risk grows where AI agents can choose the repository path. Confidence: MEDIUM, since the data comes from the vendor advisory and VulnCheck with no scoring.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Upgrade to n8n 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, disable the Git node via NODES_EXCLUDE (for example n8n-nodes-base.git) and remove it from agent tool configurations. 3) Restrict workflow creation and edit permissions to trusted users, and review which members can use the Git node. 4) Run n8n as a non-root user in a hardened container with a read-only filesystem, minimal egress and no host mounts. 5) Rotate credentials stored in n8n if untrusted members had access to vulnerable instances. 6) Detect: audit workflows using the Git node with the Log operation, look for repositories under user-writable paths, and alert on child processes spawned by git from the n8n process (for example unexpected shells or network tools).
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-110845?
n8n's Git node Log operation fails to strip a repository's local git configuration before invoking an external program (CWE-15, external control of configuration), so an authenticated member who controls a repository's local config can run arbitrary programs as the n8n process user, including when the node is exposed as an agent tool. No CVSS, EPSS, KEV or SSVC data exists yet, no public exploit or Nuclei template is known, and the vendor advisory (GHSA-x8wx-g24x-3549) plus VulnCheck are the only sources, so urgency rests on impact rather than measured exploitation. The impact is high for multi-tenant or shared n8n instances: any low-privilege member can pivot to the host, where workflow credentials, API keys and LLM provider secrets are typically stored. Upgrade to 1.123.83, 2.41.4 or 2.42.1 (or later), and until then restrict who can create or edit workflows that use the Git node and remove it from agent tool sets.
Is CVE-2026-110845 actively exploited?
No confirmed active exploitation of CVE-2026-110845 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-110845?
1) Upgrade to n8n 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, disable the Git node via NODES_EXCLUDE (for example n8n-nodes-base.git) and remove it from agent tool configurations. 3) Restrict workflow creation and edit permissions to trusted users, and review which members can use the Git node. 4) Run n8n as a non-root user in a hardened container with a read-only filesystem, minimal egress and no host mounts. 5) Rotate credentials stored in n8n if untrusted members had access to vulnerable instances. 6) Detect: audit workflows using the Git node with the Log operation, look for repositories under user-writable paths, and alert on child processes spawned by git from the n8n process (for example unexpected shells or network tools).
What systems are affected by CVE-2026-110845?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, agent tool integrations.
What is the CVSS score for CVE-2026-110845?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0050Command and Scripting InterpreterAML.T0053AI Agent Tool InvocationAML.T0083Credentials from AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.
Exploitation Scenario
An attacker holding a low-privilege n8n member account, or an attacker who has prompt-injected an agent workflow that exposes the Git node as a tool, places a repository on a path the n8n host can read, such as a cloned or uploaded repo, with a local .git/config that defines a program to run, for example through core.fsmonitor or a pager or external command setting. They configure or instruct the Git node to run the Log operation against that repository. n8n invokes git without sanitizing the local configuration, so git executes the attacker's program as the n8n process user. The attacker then reads environment variables and stored credentials, including LLM API keys, and pivots into connected systems.
Weaknesses (CWE)
CWE-15External Control of System or Configuration SettingPrimaryCWE-15External Control of System or Configuration SettingCWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
- [Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n