CVE-2026-72773 is a path confinement bypass in the n8n computer-use file search tool. A crafted search pattern can expand outside the configured base directory and return names and contents of files the daemon user can read. The record scores it 7.7, High. Upgrade to 2.31.5 or 2.32.1.
What's affected
The advisory covers the 2.x line only: anything before 2.31.5, or before 2.32.1 on the 2.32 line. The record for this CVE says before 2.32.1. The GitHub advisory lists 2.31.5 and 2.32.1 as patched, with no 1.x fix.
The affected component is the @n8n/computer-use package, in its search_files tool. The advisory says any deployment where an actor can influence the tool's search input is affected. In practice that points to AI agent workflows where a model or a user decides what to search for.
The weakness class is CWE-22, path traversal. The check that was meant to confine searches to one directory could be passed by a crafted pattern.
How to check if you're exposed
Find the version of every n8n instance you run, including containers and any copy bundled in another product.
n8n --version
docker exec <container-name> n8n --version
npm ls n8n
If the version is below the patched release for your line, you are in the affected range. Remember that n8n often runs as a base image tag in Docker or Kubernetes, so check image tags in your manifests as well as running hosts. A dependency scan of the repository that holds your deployment files will surface pinned n8n packages. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for what it finds.
Then find where the computer-use package is used. Search your workflows and agent setups for AI agents that have the computer-use tools, and note which user or model input reaches the search tool. Also check which operating system user the daemon runs as, since that user's file permissions decide what a bypass can read.
What to do now
- Upgrade n8n to 2.31.5 or 2.32.1 or later.
- If you cannot upgrade now, disable or remove AI agent workflows that use the computer-use package until the instance is patched.
- Limit instance access to fully trusted users.
- Run the n8n process under a dedicated low privilege account so that very little sits outside the intended directory.
- Check that secrets, key files and environment files are not readable by the n8n user unless required.
- After patching, rotate any credential that sat on a path the daemon could read, if you have reason to think the tool was misused.
Why it matters
Directory confinement checks usually compare a path with a base directory. A pattern is not a path until it is expanded, and a check done before expansion can miss where the expansion leads. This is a classic reason that a path check passes while the file system walk ends up elsewhere.
Scoring differs between sources. The record gives 7.7 High under CVSS 3.1, with a changed scope. The GitHub advisory rates it Moderate at 4.9 under CVSS 4.0, and VulnCheck says medium at 4.9. The gap comes from how each model treats privileges and attack requirements. If your agents take input from outside your team, lean toward the record. No source reports active exploitation, and the CVE is not in the CISA KEV catalog.
Quick check
What can an attacker read?
The names and contents of files anywhere the daemon's operating system user can read, according to the advisory.
Which deployments are exposed?
Those where an actor can influence the tool's search input, such as agent workflows that pass outside input to the file search tool.
Sources
Last reviewed: 18 October 2026.
