CVE-2026-92587: n8n: Git node sandbox escape reads files outside restriction

MEDIUM

Published September 16, 2026

CISO Take

CVE-2026-92587 is a path-resolution flaw in n8n's Git node: the sandbox check validates a relative remote URL against one directory, but git then resolves that URL from the enclosing repository's top level. An authenticated member can nest a repository one level below the allowed path and pull the contents of any git repository outside N8N_RESTRICT_FILE_ACCESS_TO, then read it back. Severity is medium (CVSS 5.0, scope changed, low confidentiality impact), and there is no KEV listing, no public exploit and no Nuclei template. EPSS is low at 0.3% (79th percentile), and CISA SSVC says TRACK. The practical risk is that any compromised or malicious member account can read other git repositories on the n8n host, and those may hold credentials or workflow secrets. Upgrade to 1.123.76, 2.37.7 or 2.38.2, or add n8n-nodes-base.git to NODES_EXCLUDE if you cannot patch yet.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium overall. The attack is network-reachable and low complexity, but it needs an authenticated member account and has no user interaction. Impact is limited to low confidentiality: only git repositories readable by the n8n process are exposed, and there is no integrity or availability impact. Exploitation likelihood is low (EPSS 0.003, no public exploit, not in KEV). Risk rises sharply on multi-tenant or shared n8n instances where members are not fully trusted and the host holds sensitive repositories. The AI-agent context matters because n8n often runs agent workflows with API keys and prompts stored in repositories on the same host.

How does the attack unfold?

Initial Access

Attacker logs in with a low-privilege member account on the n8n instance.

AML.T0012

Sandbox Escape

Attacker nests a repository below repositoryPath and uses a relative remote URL that passes the sandbox check but resolves elsewhere.

AML.T0049

Collection

A Git fetch or pull merges objects from the out-of-scope repository into the attacker's repository.

AML.T0036

Impact

Attacker reads back the merged contents, exposing secrets and code from the host.

AML.T0037

Initial Access

Attacker logs in with a low-privilege member account on the n8n instance.

AML.T0012

Sandbox Escape

Attacker nests a repository below repositoryPath and uses a relative remote URL that passes the sandbox check but resolves elsewhere.

AML.T0049

Collection

A Git fetch or pull merges objects from the out-of-scope repository into the attacker's repository.

AML.T0036

Impact

Attacker reads back the merged contents, exposing secrets and code from the host.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed 5d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.76, 2.37.7, 2.38.2 or later. 2) If you cannot patch immediately, disable the Git node by adding n8n-nodes-base.git to NODES_EXCLUDE and restarting n8n. 3) Review member accounts and remove or restrict untrusted users from creating or editing workflows. 4) Run n8n as a low-privilege user in a container, and mount only the directories it needs so that host repositories are not readable. 5) Move secrets out of git repositories on the n8n host and rotate any that may have been exposed. 6) For detection, audit workflows for Git nodes using relative remote URLs such as ../ paths, and look for unexpected fetch or pull operations and newly nested .git directories under the configured repositoryPath.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageFrameworkAgentAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0037- Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-92587?

Is CVE-2026-92587 actively exploited?

No confirmed active exploitation of CVE-2026-92587 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92587?

1) Upgrade n8n to 1.123.76, 2.37.7, 2.38.2 or later. 2) If you cannot patch immediately, disable the Git node by adding n8n-nodes-base.git to NODES_EXCLUDE and restarting n8n. 3) Review member accounts and remove or restrict untrusted users from creating or editing workflows. 4) Run n8n as a low-privilege user in a container, and mount only the directories it needs so that host repositories are not readable. 5) Move secrets out of git repositories on the n8n host and rotate any that may have been exposed. 6) For detection, audit workflows for Git nodes using relative remote URLs such as ../ paths, and look for unexpected fetch or pull operations and newly nested .git directories under the configured repositoryPath.

What systems are affected by CVE-2026-92587?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines.

What is the CVSS score for CVE-2026-92587?

CVE-2026-92587 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0037Data from Local System

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.

Exploitation Scenario

An attacker with a low-privilege member account on a shared n8n instance builds a workflow using the Git node. They create a nested repository one level below the configured repositoryPath and set a relative remote URL that passes the N8N_RESTRICT_FILE_ACCESS_TO check. When the workflow runs, git walks up to the enclosing repository's top level and resolves the same URL there, pointing at a sensitive repository elsewhere on the host, such as one holding AI agent prompts and API keys. A fetch or pull merges those objects into the attacker's repository, and a following Git node step reads the files back, exposing credentials that can be used to reach LLM providers or downstream systems.

Weaknesses (CWE)

CWE-426Untrusted Search PathPrimary CWE-426Untrusted Search Path

CWE-426 — Untrusted Search Path: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.