CVE-2026-86081: n8n ReDoS — HIGH

Q: Is CVE-2026-86081 actively exploited?

No confirmed active exploitation of CVE-2026-86081 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86081?

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately — the fix corrects the vulnerable default in N8N_BLOCK_FILE_PATTERNS (packages/@n8n/config/src/configs/security.config.ts). Until patched, restrict who can create/edit workflows with Git node clone operations (limit workflow-editor role assignment, especially for external or lower-trust users), and review any custom N8N_BLOCK_FILE_PATTERNS overrides for similarly nested-quantifier regex patterns. For detection, monitor n8n process CPU usage for sustained spikes/hangs correlated with workflow executions involving Git nodes, and alert on n8n instance unresponsiveness or health-check failures. After patching, audit workflow execution logs for suspicious Git node destination paths as an indicator of attempted exploitation prior to the fix.

Q: What systems are affected by CVE-2026-86081?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, AI agent orchestration.

Q: What is the CVSS score for CVE-2026-86081?

No CVSS score has been assigned yet.

CISO Take

n8n's Git node clone operation validates the attacker-controlled destination path against a default regular expression that is vulnerable to catastrophic backtracking, and that match runs synchronously in n8n's main process. Any authenticated user with workflow-editor permissions can craft a single workflow execution that hangs the regex engine indefinitely and freezes the entire n8n instance, taking down every other workflow and automation running on it — not just the malicious one. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not being mass-exploited, but the trigger is a single crafted string with no special tooling required once the pattern is known. Because n8n frequently orchestrates AI agent and automation pipelines, an instance-wide freeze can silently break scheduled agent runs, alerting pipelines, or integrations that depend on n8n staying responsive. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime restrict Git node/workflow-editor access to trusted users and monitor for n8n processes pegged at 100% CPU with no corresponding legitimate workload.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Low complexity, high blast-radius availability bug gated behind authentication. Exploitation requires only workflow-editor privileges (no admin/root needed) and a single crafted Git node clone path — no chained vulnerabilities, no external exploit code needed. Impact is a full-instance denial of service (main process hangs synchronously), so a single low-privileged, malicious or compromised account can take down all workflows and integrations hosted on that n8n instance. No CVSS/EPSS/KEV data exists yet and no public PoC or Nuclei template was found, keeping near-term opportunistic exploitation risk low, but any multi-tenant or shared n8n deployment with several workflow editors should treat this as a real insider/compromised-account risk, not a theoretical one.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a workflow-editor account on a shared n8n instance (insider, phished, or reused credentials).

AML.T0012

Malicious Workflow Configuration

Attacker creates a workflow with a Git node clone operation, setting the destination path to a string crafted to trigger catastrophic backtracking in the default N8N_BLOCK_FILE_PATTERNS regex.

Execution Trigger

Attacker runs the workflow, causing the regex validation to execute synchronously in n8n's main process against the malicious path.

Instance Freeze / Impact

Catastrophic backtracking pegs the CPU and blocks the Node.js event loop indefinitely, freezing the entire n8n instance and halting all other workflows and AI agent jobs it hosts.

AML.T0029

Authenticated Access

Attacker obtains or already holds a workflow-editor account on a shared n8n instance (insider, phished, or reused credentials).

AML.T0012

Malicious Workflow Configuration

Attacker creates a workflow with a Git node clone operation, setting the destination path to a string crafted to trigger catastrophic backtracking in the default N8N_BLOCK_FILE_PATTERNS regex.

Execution Trigger

Attacker runs the workflow, causing the regex validation to execute synchronously in n8n's main process against the malicious path.

Instance Freeze / Impact

Catastrophic backtracking pegs the CPU and blocks the Node.js event loop indefinitely, freezing the entire n8n instance and halting all other workflows and AI agent jobs it hosts.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.76	`1.123.76`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately — the fix corrects the vulnerable default in N8N_BLOCK_FILE_PATTERNS (packages/@n8n/config/src/configs/security.config.ts). Until patched, restrict who can create/edit workflows with Git node clone operations (limit workflow-editor role assignment, especially for external or lower-trust users), and review any custom N8N_BLOCK_FILE_PATTERNS overrides for similarly nested-quantifier regex patterns. For detection, monitor n8n process CPU usage for sustained spikes/hangs correlated with workflow executions involving Git nodes, and alert on n8n instance unresponsiveness or health-check failures. After patching, audit workflow execution logs for suspicious Git node destination paths as an indicator of attempted exploitation prior to the fix.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent Framework AML.T0012 - Valid Accounts AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operational risk management

NIST AI RMF

MANAGE 4.1 - Mechanisms are in place to manage negative impacts of AI system incidents

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-86081?

n8n's Git node clone operation validates the attacker-controlled destination path against a default regular expression that is vulnerable to catastrophic backtracking, and that match runs synchronously in n8n's main process. Any authenticated user with workflow-editor permissions can craft a single workflow execution that hangs the regex engine indefinitely and freezes the entire n8n instance, taking down every other workflow and automation running on it — not just the malicious one. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not being mass-exploited, but the trigger is a single crafted string with no special tooling required once the pattern is known. Because n8n frequently orchestrates AI agent and automation pipelines, an instance-wide freeze can silently break scheduled agent runs, alerting pipelines, or integrations that depend on n8n staying responsive. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime restrict Git node/workflow-editor access to trusted users and monitor for n8n processes pegged at 100% CPU with no corresponding legitimate workload.

Is CVE-2026-86081 actively exploited?

No confirmed active exploitation of CVE-2026-86081 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86081?

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately — the fix corrects the vulnerable default in N8N_BLOCK_FILE_PATTERNS (packages/@n8n/config/src/configs/security.config.ts). Until patched, restrict who can create/edit workflows with Git node clone operations (limit workflow-editor role assignment, especially for external or lower-trust users), and review any custom N8N_BLOCK_FILE_PATTERNS overrides for similarly nested-quantifier regex patterns. For detection, monitor n8n process CPU usage for sustained spikes/hangs correlated with workflow executions involving Git nodes, and alert on n8n instance unresponsiveness or health-check failures. After patching, audit workflow execution logs for suspicious Git node destination paths as an indicator of attempted exploitation prior to the fix.

What systems are affected by CVE-2026-86081?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, AI agent orchestration.

What is the CVSS score for CVE-2026-86081?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation pipelinesAI agent orchestration

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0029 Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation Scenario

A disgruntled contractor or an attacker who has phished/reused credentials to gain workflow-editor access to a shared n8n instance creates a new workflow containing a Git node configured for a clone operation. They set the destination path to a string specifically crafted to trigger catastrophic backtracking against the default N8N_BLOCK_FILE_PATTERNS regex (e.g., a long sequence of nested path segments resembling `.git/` variants). Executing that single workflow causes the regex engine to run exponentially long in n8n's main process thread, freezing the Node.js event loop. The entire n8n instance becomes unresponsive — every other team's workflows, scheduled jobs, webhook-triggered automations, and any AI agent pipelines relying on that instance stop processing until an operator manually restarts the service.

Weaknesses (CWE)

CWE-1333 Inefficient Regular Expression Complexity Primary CWE-1333 Inefficient Regular Expression Complexity Primary CWE-1333 Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.