AI Threat AlertCVE-2026-71539: n8n: Git node symlink race leads to RCE
UNKNOWNn8n's Git node has a time-of-check-to-time-of-use flaw: an authenticated workflow user can swap a validated clone destination for a symlink, planting a crafted repository inside n8n's community node directory so it loads as a custom JavaScript node after the next restart and runs arbitrary code on the server. This matters because n8n is widely used as the orchestration layer for AI agent workflows, meaning a compromised instance exposes every credential wired into it — LLM API keys, vector database creds, downstream SaaS tokens — not just the workflow engine itself. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active exploitation, but the barrier to entry is only workflow-editing privileges, which many self-hosted n8n deployments hand out too liberally. Patch to 1.123.64, 2.29.8, or 2.30.1 immediately; until then, restrict who can create or edit Git node workflows and audit the community node directory for unexpected entries or symlinks after any restart.
What is the risk?
Moderate-to-high risk despite the absence of a published CVSS score or EPSS data: the vulnerability requires an authenticated user with workflow-editing rights (not pre-auth), which meaningfully narrows the attack surface, but the payoff — arbitrary code execution on the n8n host — is severe. No public exploit code, PoC, or Nuclei template exists yet, and it's not in CISA KEV, so exploitation is currently theoretical rather than observed in the wild. The TOCTOU/symlink-race technique (CWE-367) is a well-understood class of bug, so a skilled attacker with n8n internals knowledge could weaponize it without novel research. Any n8n instance that allows multiple users or lower-trust roles to author workflows involving Git nodes should treat this as time-sensitive.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepUpgrade immediately to n8n 1.123.64, 2.29.8, or 2.30.1, which fix the clone-operation race condition. Until patched, restrict Git node usage and workflow-editing permissions to fully trusted users only (treat workflow-edit access as equivalent to server access). Audit the community node/custom node directory for unexpected files, symlinks, or recently added packages, especially around restart times. Monitor n8n process restarts for correlation with unexpected file system changes in the node directory, and review credential vault access logs for anomalous use following any suspected compromise. Where possible, run n8n with the node directory on a filesystem/mount that disallows symlink creation by the application user.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-71539?
n8n's Git node has a time-of-check-to-time-of-use flaw: an authenticated workflow user can swap a validated clone destination for a symlink, planting a crafted repository inside n8n's community node directory so it loads as a custom JavaScript node after the next restart and runs arbitrary code on the server. This matters because n8n is widely used as the orchestration layer for AI agent workflows, meaning a compromised instance exposes every credential wired into it — LLM API keys, vector database creds, downstream SaaS tokens — not just the workflow engine itself. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active exploitation, but the barrier to entry is only workflow-editing privileges, which many self-hosted n8n deployments hand out too liberally. Patch to 1.123.64, 2.29.8, or 2.30.1 immediately; until then, restrict who can create or edit Git node workflows and audit the community node directory for unexpected entries or symlinks after any restart.
Is CVE-2026-71539 actively exploited?
No confirmed active exploitation of CVE-2026-71539 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-71539?
Upgrade immediately to n8n 1.123.64, 2.29.8, or 2.30.1, which fix the clone-operation race condition. Until patched, restrict Git node usage and workflow-editing permissions to fully trusted users only (treat workflow-edit access as equivalent to server access). Audit the community node/custom node directory for unexpected files, symlinks, or recently added packages, especially around restart times. Monitor n8n process restarts for correlation with unexpected file system changes in the node directory, and review credential vault access logs for anomalous use following any suspected compromise. Where possible, run n8n with the node directory on a filesystem/mount that disallows symlink creation by the application user.
What systems are affected by CVE-2026-71539?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.
What is the CVSS score for CVE-2026-71539?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.005AI Agent ToolAML.T0012Valid AccountsAML.T0050Command and Scripting InterpreterAML.T0081Modify AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Exploitation Scenario
An authenticated n8n user with workflow-editing rights (an insider, a compromised low-privilege account, or a malicious collaborator on a shared instance) creates a workflow using the Git node's clone operation, pointing at a repository they control. During the brief window between n8n validating the destination directory and actually performing the clone, the attacker races to replace that directory with a symlink pointing into n8n's community node directory. The clone then writes the attacker's crafted repository — disguised as a legitimate community node package — into that trusted location. On the next n8n restart (or community node reload), the platform loads the planted code as a custom JavaScript node and executes it with the full privileges of the n8n process, giving the attacker access to every credential stored in the instance, including LLM API keys and any AI agent tool integrations configured in workflows.
Weaknesses (CWE)
CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionPrimaryCWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
- [Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- [Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n