Which versions of n8n are affected by CVE-2026-65598?

n8n workflow automation (self-hosted and cloud versions) contains a critical remote code execution vulnerability that allows authenticated users to exploit a TOCTOU race condition in Git operations…. A patch is available.

How to fix or mitigate CVE-2026-65598?

Within 24 hours, enumerate all n8n deployments and document their current versions and data exposure. Within 7 days, immediately implement interim mitigations by restricting Git node access to administrators only, isolating n8n infrastructure on a separate network segment, and enabling detailed audit logging. Within 30 days, establish a vendor monitoring process for security patches, conduct a retrospective review of Git node usage logs, and prepare an emergency patching procedure for when vendor-released patches become available.

n8n CVE-2026-65598

Q: What is the CVSS score of CVE-2026-65598?

CVE-2026-65598 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-47642 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-22 VulnCheck

GHSA-725q-c4vp-q4cg

GHSA-g3r5-9h93-4j2c

Authentication Bypass N8n

8.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable via an authenticated low-priv account (PR:L); the TOCTOU race and deferred restart make it AC:H; escaping the app to run host JS is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 13:02 EUVD

Analysis Generated

Jul 22, 2026 - 12:22 vuln.today

CVE Published

Jul 22, 2026 - 11:21 cve.org

HIGH 8.9

DescriptionCVE.org

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

AnalysisAI

Server-side remote code execution in n8n workflow automation (self-hosted and cloud) before 1.123.64, 2.29.8, and 2.30.1 lets authenticated users abuse a TOCTOU race in the Git node's clone operation to write a malicious repository into the community node directory, which n8n auto-loads and executes on the next restart. The flaw bypasses path validation by swapping a validated directory for a symlink before the clone runs, turning a low-privilege account into arbitrary JavaScript execution on the host. No public exploit identified at time of analysis; reported by VulnCheck.

Technical ContextAI

n8n is a Node.js-based workflow automation platform whose Git node wraps clone/pull operations, and which supports 'community' (custom) nodes loaded from a designated directory at startup. The vulnerability is CWE-367 (Time-of-Check to Time-of-Use race): the clone target path is validated once, but between that check and the actual filesystem write the attacker replaces the checked directory with a symlink, so the clone lands outside the intended sandbox - specifically in the community node directory. Because n8n dynamically requires/executes JavaScript from community nodes when the process restarts, a planted repository containing hostile node code runs in the server's Node.js process. Affected CPE is cpe:2.3:a:n8n-io:n8n across the vulnerable version ranges.

RemediationAI

Upgrade to a fixed release: Vendor-released patch: n8n 1.123.64, 2.29.8, or 2.30.1 (choose the fixed version on your current branch), per advisory GHSA-g3r5-9h93-4j2c (https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c); n8n Cloud is remediated by the vendor. Where immediate patching is not possible, reduce exposure by restricting who can create or run workflows using the Git node - limit accounts to trusted operators and remove Git node access from low-trust users, since exploitation requires an authenticated user driving that node. As compensating controls, disable or block loading of community/custom nodes (set the environment so community packages are not loaded at startup, e.g. do not enable community node execution) to break the load-and-execute step - trade-off: legitimate community nodes stop working - and run the n8n process as an unprivileged, containerized user with a read-only or tightly permissioned community node directory so a planted repository cannot be written or executed. Monitor the community node directory for unexpected repositories and audit Git node usage.