CVE-2026-72770: n8n path traversal

CISO Take

A path traversal flaw in n8n's Git node lets authenticated users with workflow create/execute rights point the fetch, pull, and push-tags operations at local filesystem paths instead of the allowlisted remote repositories, bypassing the containment checks meant to keep workflows sandboxed. Because n8n is widely used to orchestrate AI agent tool chains, any tenant or low-privilege automation user with workflow-build rights can pull arbitrary local git repositories into a workflow and read their files and commit history, which is a lateral-movement and data-exposure risk in shared or multi-tenant n8n deployments. Exploitation likelihood is currently low — EPSS sits at 0.47% and CISA's SSVC decision is TRACK, there's no public exploit or Nuclei template, and it's not in the KEV catalog — but the flaw requires only workflow-authoring privileges rather than admin access, which is a common permission level in AI automation teams. Patch to n8n 1.123.67 or later; until then, restrict Git node usage and workflow-create/execute permissions to trusted users, and audit existing workflows for Git node configurations pointing at non-remote (local path) sources. Monitor Git node executions and file access logs for unexpected local-path remotes as a compensating control.

Sources: NVD EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

Low-to-moderate risk today given the absence of a public exploit, scanner coverage, or KEV listing, and an EPSS score under 0.5% — this is a TRACK-tier SSVC vulnerability, not an emergency-patch item. However, the barrier to exploitation is low technically (crafting a local path instead of a remote URL) and the required privilege (workflow create/execute) is commonly granted to non-admin automation builders in n8n instances used for AI agent orchestration, so the practical attack surface is larger than the CVSS-less severity rating suggests. Multi-tenant or shared n8n deployments where AI agent workflows are built by many users carry the highest exposure.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated n8n account with workflow create/execute rights, a common privilege level for automation builders.

AML.T0012

Exploitation

Attacker configures the Git node's fetch/pull/push-tags operation with a local filesystem path instead of an allowlisted remote, bypassing the repository-path containment check (CWE-22).

AML.T0053

Data Access

The Git node executes against the local path, pulling the arbitrary repository's files and commit history into the workflow.

AML.T0037

Impact

Attacker reads or exfiltrates exposed files, secrets, and git history via the workflow output, breaching intended sandbox isolation.

AML.T0025

Initial Access

Attacker obtains or already holds an authenticated n8n account with workflow create/execute rights, a common privilege level for automation builders.

AML.T0012

Exploitation

Attacker configures the Git node's fetch/pull/push-tags operation with a local filesystem path instead of an allowlisted remote, bypassing the repository-path containment check (CWE-22).

AML.T0053

Data Access

The Git node executes against the local path, pulling the arbitrary repository's files and commit history into the workflow.

AML.T0037

Impact

Attacker reads or exfiltrates exposed files, secrets, and git history via the workflow output, breaching intended sandbox isolation.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
206.1K OpenSSF 6.7 Pushed 5d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to n8n 1.123.67 or later, where the repository-path containment checks are fixed. As an interim workaround, restrict which users/roles can create or execute workflows containing Git nodes, and review existing workflows for fetch/pull/push-tags configurations referencing local filesystem paths rather than legitimate remote URLs. Add detection for Git node executions with non-URL 'remote' values and for unexpected local-path repository reads in audit/execution logs. Where possible, run n8n workers in isolated containers per tenant to limit the blast radius of any sandbox-containment bypass.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1 - Risk monitoring of deployed AI systems

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-72770?

A path traversal flaw in n8n's Git node lets authenticated users with workflow create/execute rights point the fetch, pull, and push-tags operations at local filesystem paths instead of the allowlisted remote repositories, bypassing the containment checks meant to keep workflows sandboxed. Because n8n is widely used to orchestrate AI agent tool chains, any tenant or low-privilege automation user with workflow-build rights can pull arbitrary local git repositories into a workflow and read their files and commit history, which is a lateral-movement and data-exposure risk in shared or multi-tenant n8n deployments. Exploitation likelihood is currently low — EPSS sits at 0.47% and CISA's SSVC decision is TRACK, there's no public exploit or Nuclei template, and it's not in the KEV catalog — but the flaw requires only workflow-authoring privileges rather than admin access, which is a common permission level in AI automation teams. Patch to n8n 1.123.67 or later; until then, restrict Git node usage and workflow-create/execute permissions to trusted users, and audit existing workflows for Git node configurations pointing at non-remote (local path) sources. Monitor Git node executions and file access logs for unexpected local-path remotes as a compensating control.

Is CVE-2026-72770 actively exploited?

No confirmed active exploitation of CVE-2026-72770 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-72770?

Upgrade to n8n 1.123.67 or later, where the repository-path containment checks are fixed. As an interim workaround, restrict which users/roles can create or execute workflows containing Git nodes, and review existing workflows for fetch/pull/push-tags configurations referencing local filesystem paths rather than legitimate remote URLs. Add detection for Git node executions with non-URL 'remote' values and for unexpected local-path repository reads in audit/execution logs. Where possible, run n8n workers in isolated containers per tenant to limit the blast radius of any sandbox-containment bypass.

What systems are affected by CVE-2026-72770?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

What is the CVSS score for CVE-2026-72770?

CVE-2026-72770 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at local paths outside the sandbox to pull arbitrary git repositories and read their files and history.

Exploitation Scenario

A contractor or lower-privileged team member with workflow build/execute rights on a shared n8n instance creates a workflow using the Git node's pull operation, but instead of supplying a legitimate git remote URL, configures it with a local filesystem path (e.g., pointing at another tenant's repo checkout or a system directory containing secrets). The containment check that should restrict the Git node to allowlisted remotes fails to validate that the target is actually a remote rather than a local path, so n8n executes the pull against the local directory, exposing its files and full commit history — including any embedded credentials, API keys, or proprietary agent prompts — directly in the workflow's output, which the attacker can then read or exfiltrate.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.