AI Threat Alert
A flaw in n8n's Git node lets an authenticated workflow editor bypass the platform's repository-URL validation by abusing the setUpstream operation, which writes an unvalidated branch..remote value into the local Git config; a subsequent fetch or pull then reads from that poisoned config instead of the checked parameter, letting the attacker point Git at any local repository the n8n process can read and exfiltrate its contents through the workflow output. This isn't remote-unauthenticated — it requires an existing workflow-editor account — but n8n is widely used to orchestrate AI agent pipelines that often sit alongside credential stores, private automation repos, or agent configuration checked out locally, so the blast radius includes anything readable by the n8n service account, not just the intended repo. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit/Nuclei template for this issue yet, so exploitation likelihood is currently low and opportunistic, but the technique is trivial to reproduce once understood and insider/low-privilege abuse is the realistic threat model. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately; until then, restrict who can create or edit workflows containing the Git node and audit any Git-node workflows for anomalous remote/upstream configuration changes.
What is the risk?
Moderate risk. The vulnerability requires authenticated access with workflow-editing privileges, which limits the attack surface to insiders, compromised low-privilege accounts, or third parties granted workflow access (e.g., contractors, shared n8n instances). There is no CVSS score published, no EPSS percentile, no CISA KEV listing, and no known public exploit or scanner template, so opportunistic mass exploitation is unlikely. However, the exploitation mechanics are simple (abusing a documented Git operation, setUpstream, rather than requiring novel research), and the impact — arbitrary local file/repository disclosure scoped to whatever the n8n process account can read — can be severe in shared or multi-tenant n8n deployments where workflow editors should not have host-level file access.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | < 1.123.76 | 1.123.76 |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step-
1) Patch immediately to n8n 1.123.76, 2.37.7, or 2.38.2. 2) Until patched, restrict Git-node usage via role-based workflow permissions so only trusted administrators can create/edit workflows containing Git nodes. 3) Audit existing workflows for Git nodes with unexpected repository parameters or recent changes to branch/remote settings. 4) Review n8n process-level file permissions and ensure the service account cannot read sensitive local repositories, credential files, or SSH keys beyond what automation strictly requires (principle of least privilege at the OS level). 5) Monitor n8n execution logs for Git node fetch/pull operations against unexpected local paths as a detection signal. 6) If using n8n cloud or a shared multi-tenant instance, confirm with the vendor/provider that the patched version is deployed.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-86995?
A flaw in n8n's Git node lets an authenticated workflow editor bypass the platform's repository-URL validation by abusing the setUpstream operation, which writes an unvalidated branch..remote value into the local Git config; a subsequent fetch or pull then reads from that poisoned config instead of the checked parameter, letting the attacker point Git at any local repository the n8n process can read and exfiltrate its contents through the workflow output. This isn't remote-unauthenticated — it requires an existing workflow-editor account — but n8n is widely used to orchestrate AI agent pipelines that often sit alongside credential stores, private automation repos, or agent configuration checked out locally, so the blast radius includes anything readable by the n8n service account, not just the intended repo. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit/Nuclei template for this issue yet, so exploitation likelihood is currently low and opportunistic, but the technique is trivial to reproduce once understood and insider/low-privilege abuse is the realistic threat model. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately; until then, restrict who can create or edit workflows containing the Git node and audit any Git-node workflows for anomalous remote/upstream configuration changes.
Is CVE-2026-86995 actively exploited?
No confirmed active exploitation of CVE-2026-86995 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-86995?
1) Patch immediately to n8n 1.123.76, 2.37.7, or 2.38.2. 2) Until patched, restrict Git-node usage via role-based workflow permissions so only trusted administrators can create/edit workflows containing Git nodes. 3) Audit existing workflows for Git nodes with unexpected repository parameters or recent changes to branch/remote settings. 4) Review n8n process-level file permissions and ensure the service account cannot read sensitive local repositories, credential files, or SSH keys beyond what automation strictly requires (principle of least privilege at the OS level). 5) Monitor n8n execution logs for Git node fetch/pull operations against unexpected local paths as a detection signal. 6) If using n8n cloud or a shared multi-tenant instance, confirm with the vendor/provider that the patched version is deployed.
What systems are affected by CVE-2026-86995?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines.
What is the CVSS score for CVE-2026-86995?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012 Valid Accounts AML.T0037 Data from Local System AML.T0083 Credentials from AI Agent Configuration Compliance Controls Affected
What are the technical details?
Original Advisory
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Exploitation Scenario
An attacker gains workflow-editor access to a shared n8n instance — either as a legitimate but lower-trust user, a compromised account, or a malicious insider. They add a Git node to a workflow and invoke the setUpstream operation, supplying a crafted branch..remote value that points to a local path outside the intended repository (e.g., a path containing another team's private automation repo, a credentials-bearing config repo, or an SSH-key-backed clone). Because setUpstream writes this value into the repository's Git config without the same validation applied to the checked repository parameter, the config now silently points elsewhere. The attacker then triggers a fetch or pull operation on the same node; n8n resolves the remote from the poisoned config rather than the originally validated parameter, retrieves the contents of the arbitrary local repository, and surfaces them in the workflow's output — which the attacker can view, export, or route to an external destination via subsequent workflow nodes.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-73 External Control of File Name or Path
Primary
CWE-73 External Control of File Name or Path
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-73 External Control of File Name or Path CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2026-27577 9.9 n8n: Code Injection enables RCE
Same package: n8n CVE-2026-27495 9.9 n8n: Code Injection enables RCE
Same package: n8n