CVE-2026-72773: n8n path traversal leaks arbitrary

CISO Take

n8n's built-in computer-use file-search tool (search_files) contains a path-confinement bypass: a specially crafted search pattern lets the tool ignore its configured base-directory restriction and return the names and contents of arbitrary files readable by the daemon's OS user, including credentials, .env files, and SSH keys. Because n8n workflows routinely hand this tool to AI agents that process untrusted input from webhooks, chat, or third-party integrations, any actor able to influence the search pattern — directly or via prompt injection — can turn a scoped file-search capability into unrestricted local file disclosure. Exploitation likelihood is currently modest (EPSS 0.38%, ~69th percentile, no public PoC, not in CISA KEV, SSVC rated TRACK), but the blast radius is high anywhere n8n's computer-use tools are exposed to external or semi-trusted input. Upgrade to n8n 2.31.5 or 2.32.1+ immediately; until then, disable search_files for untrusted-input agents and run the n8n daemon under a least-privilege OS account so a bypass exposes nothing sensitive.

Sources: NVD GitHub Advisory EPSS ATLAS VulnCheck

What is the risk?

Currently low-to-moderate likelihood of exploitation (EPSS 0.38%, no public exploit or Nuclei template, not in CISA KEV, SSVC TRACK) but high potential impact given the tool's explicit purpose is local file access on behalf of an AI agent. No special privileges are required beyond the ability to influence the tool's search input, which in many n8n deployments originates from webhook payloads, chat messages, or other externally-controlled data feeding an agent workflow. This asymmetry — trivial trigger, high-value data exposure — means risk should be treated as elevated wherever n8n's computer-use tools are wired to agents ingesting untrusted content, regardless of the current low EPSS score.

How does the attack unfold?

Entry point

Attacker gains a channel to influence the search_files tool's input, either as a direct workflow user or via content later ingested by the agent (e.g., webhook payload).

AML.T0053

Confinement bypass

A crafted search pattern exploits the flawed base-directory check (CWE-22), letting the tool traverse outside its configured directory.

AML.T0037

Arbitrary file disclosure

The tool returns names and contents of files readable by the n8n daemon's OS user, including credentials and keys, into the agent's output.

AML.T0086

Impact

Attacker reads or exfiltrates the disclosed secrets via the agent's response channel, enabling further compromise of the host or connected services.

Entry point

Attacker gains a channel to influence the search_files tool's input, either as a direct workflow user or via content later ingested by the agent (e.g., webhook payload).

AML.T0053

Confinement bypass

A crafted search pattern exploits the flawed base-directory check (CWE-22), letting the tool traverse outside its configured directory.

AML.T0037

Arbitrary file disclosure

The tool returns names and contents of files readable by the n8n daemon's OS user, including credentials and keys, into the agent's output.

AML.T0086

Impact

Attacker reads or exfiltrates the disclosed secrets via the agent's response channel, enabling further compromise of the host or connected services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
206.1K OpenSSF 6.7 Pushed 5d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I None

A None

What should I do?

1 step

1) Patch immediately to n8n >=2.31.5 (2.31.x branch) or >=2.32.1 (2.32.x branch) — GHSA-pf2q-pxhf-hgmw confirms the confinement-check fix. 2) Until patched, disable or remove the search_files/@n8n/computer-use tool from any agent that processes input from webhooks, chat interfaces, or third-party integrations. 3) Run the n8n daemon under a dedicated least-privilege OS account with no access to secrets, SSH keys, or other services' credentials, so a successful bypass has minimal blast radius. 4) Detection: monitor n8n execution logs for search_files invocations containing path-traversal patterns (../, absolute paths, symlink-like sequences) or search patterns derived from dynamic workflow input rather than static configuration.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0037 - Data from Local System AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-72773?

n8n's built-in computer-use file-search tool (search_files) contains a path-confinement bypass: a specially crafted search pattern lets the tool ignore its configured base-directory restriction and return the names and contents of arbitrary files readable by the daemon's OS user, including credentials, .env files, and SSH keys. Because n8n workflows routinely hand this tool to AI agents that process untrusted input from webhooks, chat, or third-party integrations, any actor able to influence the search pattern — directly or via prompt injection — can turn a scoped file-search capability into unrestricted local file disclosure. Exploitation likelihood is currently modest (EPSS 0.38%, ~69th percentile, no public PoC, not in CISA KEV, SSVC rated TRACK), but the blast radius is high anywhere n8n's computer-use tools are exposed to external or semi-trusted input. Upgrade to n8n 2.31.5 or 2.32.1+ immediately; until then, disable search_files for untrusted-input agents and run the n8n daemon under a least-privilege OS account so a bypass exposes nothing sensitive.

Is CVE-2026-72773 actively exploited?

No confirmed active exploitation of CVE-2026-72773 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-72773?

1) Patch immediately to n8n >=2.31.5 (2.31.x branch) or >=2.32.1 (2.32.x branch) — GHSA-pf2q-pxhf-hgmw confirms the confinement-check fix. 2) Until patched, disable or remove the search_files/@n8n/computer-use tool from any agent that processes input from webhooks, chat interfaces, or third-party integrations. 3) Run the n8n daemon under a dedicated least-privilege OS account with no access to secrets, SSH keys, or other services' credentials, so a successful bypass has minimal blast radius. 4) Detection: monitor n8n execution logs for search_files invocations containing path-traversal patterns (../, absolute paths, symlink-like sequences) or search patterns derived from dynamic workflow input rather than static configuration.

What systems are affected by CVE-2026-72773?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, computer-use agents, AI agent tool integrations.

What is the CVSS score for CVE-2026-72773?

CVE-2026-72773 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscomputer-use agentsAI agent tool integrations

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.

Exploitation Scenario

An organization runs an n8n agent that answers natural-language questions by searching a scoped project directory via the search_files tool (e.g., "find the deployment config"). An attacker — either a malicious user of the workflow or someone who can inject content the agent later processes, such as via a webhook payload or ingested document — crafts a search pattern designed to escape the configured base directory. The confinement check fails to catch the crafted pattern, the tool walks outside its intended scope, and returns the names and contents of files like .env or ~/.ssh/id_rsa to the agent's output, which the attacker then reads directly or exfiltrates through the agent's normal response channel.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.