AI Threat AlertCVE-2026-92588: n8n: Source control push flaw enables cross-project deletion
MEDIUMn8n's source control push endpoint trusted the file paths and status supplied by the client rather than the server-computed status for the requesting user. An authenticated project admin could therefore push deletions of workflows and credentials belonging to projects they cannot access, causing cross-project data destruction. Risk is limited: CVSS is 4.4, exploitation requires high privileges and high complexity, and the licensed Source Control (Environments) enterprise feature must be enabled and connected to a remote repository. It is not in CISA KEV, has no public exploit or Nuclei template, EPSS is 0.00322 (77th percentile), and CISA SSVC says TRACK. Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 during normal patch cycles, and prioritize multi-tenant or multi-team instances that hold sensitive credentials for AI agent workflows.
What is the risk?
Overall risk is low to medium. Exploitation needs an authenticated, high-privilege project-scoped user plus a licensed and configured Source Control feature, and the CVSS vector rates attack complexity as high. There is no confidentiality or availability impact, only integrity (I:H). The weakness is CWE-639, an authorization bypass through a user-controlled key. There is no known exploitation, no public PoC, and a low EPSS. The main exposure is insider or compromised-project-admin abuse in shared n8n environments, where destroyed workflows and credentials could disrupt AI agent automations.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 or later. 2) Until patched, restrict project admin roles, and consider disabling Source Control (Environments) push on instances with multiple untrusted projects. 3) Limit write access to the connected remote repository and enable branch protection or required reviews so unexpected deletions can be reverted. 4) Keep regular backups of workflows and credentials, and use git history to restore deleted items. 5) Detect by auditing source control push events and repository commits for deletions of files that belong to projects the pushing user cannot access. 6) Review project-admin membership and apply least privilege.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-92588?
n8n's source control push endpoint trusted the file paths and status supplied by the client rather than the server-computed status for the requesting user. An authenticated project admin could therefore push deletions of workflows and credentials belonging to projects they cannot access, causing cross-project data destruction. Risk is limited: CVSS is 4.4, exploitation requires high privileges and high complexity, and the licensed Source Control (Environments) enterprise feature must be enabled and connected to a remote repository. It is not in CISA KEV, has no public exploit or Nuclei template, EPSS is 0.00322 (77th percentile), and CISA SSVC says TRACK. Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 during normal patch cycles, and prioritize multi-tenant or multi-team instances that hold sensitive credentials for AI agent workflows.
Is CVE-2026-92588 actively exploited?
No confirmed active exploitation of CVE-2026-92588 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-92588?
1) Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 or later. 2) Until patched, restrict project admin roles, and consider disabling Source Control (Environments) push on instances with multiple untrusted projects. 3) Limit write access to the connected remote repository and enable branch protection or required reviews so unexpected deletions can be reverted. 4) Keep regular backups of workflows and credentials, and use git history to restore deleted items. 5) Detect by auditing source control push events and repository commits for deletions of files that belong to projects the pushing user cannot access. 6) Review project-admin membership and apply least privilege.
What systems are affected by CVE-2026-92588?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, multi-tenant AI orchestration, LLM integration pipelines.
What is the CVSS score for CVE-2026-92588?
CVE-2026-92588 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.32%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0101Data Destruction via AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.
Exploitation Scenario
An attacker holds or compromises a project admin account in a shared n8n instance that uses Source Control with a remote Git repository. They craft a push request that lists file paths and statuses for workflows and credentials belonging to another team's project, marked as deleted. The server uses the client-supplied list instead of its own status computation, and pushes the deletions to the remote. The other team's AI agent workflows and stored credentials are removed, causing outages and loss of configuration until they are restored from backups.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n