CVE-2026-72767: High Code Execution in n8n Git Node

CVE-2026-72767 is a command execution flaw in the n8n Git node. A user who can create and run workflows can stage a crafted local repository so that git runs hooks as the n8n process user. The record scores it 8.8, High. Upgrade to 1.123.67, 2.31.5 or 2.32.1, or exclude the Git node.

What's affected

The advisory lists affected versions as anything before 1.123.67 on the 1.x line, before 2.31.5 on the 2.31 line, and before 2.32.1 on the 2.32 line. The patched releases are 1.123.67, 2.31.5 and 2.32.1.

The advisory says both self-hosted and cloud instances are affected where authenticated users can create and execute workflows that use the Git node. The attacker needs an account with workflow rights, so this is not an anonymous flaw. It does turn a workflow editor into someone who can run commands on the host, which many teams do not intend to allow.

The weakness class is CWE-78, improper neutralization of special elements used in an OS command.

How to check if you're exposed

Find the version of every n8n instance you run, including containers and any copy bundled in another product.

n8n --version
docker exec <container-name> n8n --version
npm ls n8n

If the version is below the patched release for your line, you are in the affected range. Remember that n8n often runs as a base image tag in Docker or Kubernetes, so check image tags in your manifests as well as running hosts. A dependency scan of the repository that holds your deployment files will surface pinned n8n packages. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for what it finds.

The advisory describes a workaround that also works as a check. If n8n-nodes-base.git appears in your NODES_EXCLUDE variable, the node is disabled.

env | grep NODES_EXCLUDE

Also list who holds workflow create and execute rights. Each of those accounts is a potential path to the host until you patch.

What to do now

1. Upgrade n8n to 1.123.67, 2.31.5 or 2.32.1 or later.
2. If you cannot upgrade now, add n8n-nodes-base.git to the NODES_EXCLUDE environment variable to disable the Git node.
3. Limit instance access to fully trusted users until the patch is in.
4. Restrict network egress from the n8n host, as the advisory suggests, to reduce the impact of any command execution.
5. Run n8n as a low privilege user and never as root, so that a command run by the process has little to reach.
6. Review recent workflow changes that use the Git node, and check the host for unexpected repositories or processes.

Why it matters

Git can run scripts, called hooks, at certain steps of its normal work. That is useful on a developer laptop and dangerous on a server that handles repositories from others. When a workflow can stage a local repository that carries its own hooks, running a Git step becomes running the author's script.

The scoring is consistent here. The record gives 8.8 under CVSS 3.1. The GitHub advisory rates it High at 8.7 under CVSS 4.0, and VulnCheck also says high at 8.7. The practical answer does not depend on which scale you read. If more than a few people can build workflows on your instance, this is a priority upgrade. The sources do not report exploitation in the wild, and the CVE is not on the CISA KEV list.

Quick check

Sources

• GitHub security advisory for the n8n project
• VulnCheck advisory

Last reviewed: 18 October 2026.