Improper access control in n8n - #VU139110
Published: July 22, 2026
Vulnerability identifier: #VU139110
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: n8n
Affected software:
n8n
n8n
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Git node fetch, pull, and push-tags operations when processing an allowlisted remote configuration value that points to a local path outside the intended sandbox. A remote user can configure a local path outside the sandbox and pull an arbitrary local git repository into the workspace to disclose sensitive information.
Exploitation requires workflow create and execute rights.
Remediation
Install security update from vendor's website.