CVE-2026-65598: n8n Git clone TOCTOU race allows RCE

Q: Is CVE-2026-65598 actively exploited?

No confirmed active exploitation of CVE-2026-65598 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65598?

1) Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately — this is the only complete fix for the TOCTOU logic flaw. 2) Until patched, restrict which users/roles can configure or execute Git node clone operations, since exploitation requires an authenticated user with that capability. 3) Audit the community node / custom node directory for unexpected repositories, symlinks, or files with unfamiliar commit history, especially before any planned restart. 4) Monitor filesystem integrity (e.g., auditd/inotify on the community node path) for directory-to-symlink swaps as a detection signal. 5) Review n8n instance logs for anomalous Git node clone activity or newly loaded custom nodes correlated with server restarts. 6) For cloud n8n instances, confirm with the vendor that the patched version has been rolled out tenant-wide.

Q: What systems are affected by CVE-2026-65598?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration, plugin/tool ecosystems.

Q: What is the CVSS score for CVE-2026-65598?

No CVSS score has been assigned yet.

CISO Take

A time-of-check/time-of-use race condition in n8n's Git node lets an authenticated user swap a validated directory for a symlink in the split-second between path validation and the actual clone, planting a malicious repository inside n8n's community node directory that gets loaded as a trusted custom node on the next restart — full arbitrary JavaScript execution on the server. There's no public exploit or scanner template yet and it isn't in CISA KEV, but the barrier to entry is just an authenticated n8n account (not admin), the impact is complete server compromise on both self-hosted and cloud deployments, and n8n is a widely deployed AI agent orchestration platform with 16 tracked downstream dependents and 150 other CVEs on record, so its overall security posture (OpenSSF Scorecard 6.6/10) warrants proactive patching rather than waiting for exploitation signals. Because this touches the AI agent/workflow layer directly, a compromised n8n instance means an attacker can also manipulate or exfiltrate data from any connected LLM APIs, credentials, or downstream agent tools. Patch immediately to 1.123.64, 2.29.8, or 2.30.1; until patched, restrict Git node usage to trusted admins only and audit the community node directory for unexpected repositories after any restart.

Sources: NVD GitHub Advisory OpenSSF ATLAS

What is the risk?

Moderate-to-high risk despite the absence of EPSS scoring, KEV listing, or public exploit code. The vulnerability requires only authenticated access (not necessarily admin) to n8n, which is a much lower bar than unauthenticated RCE but still gates opportunistic mass exploitation — this is a targeted or insider-adjacent threat rather than an internet-wide scanning risk today. However, TOCTOU race conditions are a well-understood exploitation class, exploit reliability can often be improved with retries, and the payoff (arbitrary code execution on the orchestration server) is severe. The lack of a Nuclei template or ExploitDB entry suggests exploitation is not yet trivialized, but that can change quickly once a PoC circulates given the vendor advisory and VulnCheck writeup are already public.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds an authenticated n8n account with permission to configure a Git node clone operation.

TOCTOU Exploitation

Attacker races the clone operation, swapping the validated target directory for a symlink after path checks pass but before the clone executes, redirecting the write into the community node directory.

AML.T0011.002

Persistence via Node Loading

The planted repository is treated as a legitimate community node and n8n loads it automatically on the next restart.

AML.T0081

Arbitrary Code Execution

The malicious node's JavaScript executes with the privileges of the n8n server process, giving the attacker full compromise of the instance and its connected credentials.

AML.T0050

Authenticated Access

Attacker obtains or already holds an authenticated n8n account with permission to configure a Git node clone operation.

TOCTOU Exploitation

Attacker races the clone operation, swapping the validated target directory for a symlink after path checks pass but before the clone executes, redirecting the write into the community node directory.

AML.T0011.002

Persistence via Node Loading

The planted repository is treated as a legitimate community node and n8n loads it automatically on the next restart.

AML.T0081

Arbitrary Code Execution

The malicious node's JavaScript executes with the privileges of the n8n server process, giving the attacker full compromise of the instance and its connected credentials.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

1) Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately — this is the only complete fix for the TOCTOU logic flaw. 2) Until patched, restrict which users/roles can configure or execute Git node clone operations, since exploitation requires an authenticated user with that capability. 3) Audit the community node / custom node directory for unexpected repositories, symlinks, or files with unfamiliar commit history, especially before any planned restart. 4) Monitor filesystem integrity (e.g., auditd/inotify on the community node path) for directory-to-symlink swaps as a detection signal. 5) Review n8n instance logs for anomalous Git node clone activity or newly loaded custom nodes correlated with server restarts. 6) For cloud n8n instances, confirm with the vendor that the patched version has been rolled out tenant-wide.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.002 - Poisoned AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 - Third-party and supplier management for AI system components

NIST AI RMF

GOVERN 6.1 - Policies and procedures address AI risks from third-party components

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-65598?

A time-of-check/time-of-use race condition in n8n's Git node lets an authenticated user swap a validated directory for a symlink in the split-second between path validation and the actual clone, planting a malicious repository inside n8n's community node directory that gets loaded as a trusted custom node on the next restart — full arbitrary JavaScript execution on the server. There's no public exploit or scanner template yet and it isn't in CISA KEV, but the barrier to entry is just an authenticated n8n account (not admin), the impact is complete server compromise on both self-hosted and cloud deployments, and n8n is a widely deployed AI agent orchestration platform with 16 tracked downstream dependents and 150 other CVEs on record, so its overall security posture (OpenSSF Scorecard 6.6/10) warrants proactive patching rather than waiting for exploitation signals. Because this touches the AI agent/workflow layer directly, a compromised n8n instance means an attacker can also manipulate or exfiltrate data from any connected LLM APIs, credentials, or downstream agent tools. Patch immediately to 1.123.64, 2.29.8, or 2.30.1; until patched, restrict Git node usage to trusted admins only and audit the community node directory for unexpected repositories after any restart.

Is CVE-2026-65598 actively exploited?

No confirmed active exploitation of CVE-2026-65598 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65598?

1) Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately — this is the only complete fix for the TOCTOU logic flaw. 2) Until patched, restrict which users/roles can configure or execute Git node clone operations, since exploitation requires an authenticated user with that capability. 3) Audit the community node / custom node directory for unexpected repositories, symlinks, or files with unfamiliar commit history, especially before any planned restart. 4) Monitor filesystem integrity (e.g., auditd/inotify on the community node path) for directory-to-symlink swaps as a detection signal. 5) Review n8n instance logs for anomalous Git node clone activity or newly loaded custom nodes correlated with server restarts. 6) For cloud n8n instances, confirm with the vendor that the patched version has been rolled out tenant-wide.

What systems are affected by CVE-2026-65598?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration, plugin/tool ecosystems.

What is the CVSS score for CVE-2026-65598?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestrationplugin/tool ecosystems

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.002 Poisoned AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

Exploitation Scenario

An attacker with a low-privilege but authenticated n8n account configures a Git node to clone a repository into what appears to be a permitted path. Immediately after n8n's path-restriction check validates the target directory but before the actual `git clone` executes, the attacker races to delete that directory and replace it with a symlink pointing into n8n's community node directory (a classic TOCTOU window). The clone operation then follows the symlink and writes the attacker's crafted repository — containing malicious JavaScript disguised as a node package — directly into the trusted community node location. On the next n8n restart (scheduled maintenance, crash, or an attacker-triggered restart via another vector), n8n auto-loads all community nodes, executing the attacker's JavaScript with the full privileges of the n8n server process, granting the attacker persistent code execution and access to all workflow credentials and connected AI/agent integrations.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.