n8n CVE-2026-65598

Exploitation requires an authenticated n8n account with the ability to use the Git node's clone operation (CVSS PR:L), and the attacker must win a filesystem race: swap the validated clone target directory for a symlink in the interval between path validation and the clone write (CWE-367 TOCTOU). Success further depends on n8n's community/custom node loading being active so the planted repository in the community node directory is loaded and executed on the next server restart, and on the attacker being able to influence the clone path and control a repository. Limiting factors: authentication is mandatory (no unauthenticated path), the attack requirement AT:P and high complexity AC:H reflect that the race is not reliably won on a single try, and code execution is deferred until an n8n restart occurs - so instances that rarely restart or that disable community nodes materially reduce practical exploitability.

The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.9) is internally consistent with the description: network-reachable, but requiring an authenticated low-privilege account (PR:L), a non-trivial exploit path (AC:H), and a race-window attack requirement (AT:P) that is not always winnable on the first attempt. Real-world priority is elevated by the full high impact to confidentiality, integrity, and availability plus a scope-changing effect (SC:H) - it converts an app-level account into host code execution - but tempered by the authentication requirement and the timing/race precondition, which favor a deliberate attacker over opportunistic mass exploitation. No EPSS score, KEV listing, or SSVC decision data was provided, so automatability and in-the-wild exploitation cannot be asserted; the absence of a public POC further suggests exploitation would currently be targeted rather than commodity. Net: a genuine high-severity RCE that warrants prompt patching wherever untrusted or numerous users hold n8n accounts, but not a drive-by unauthenticated worm.

A low-privilege but authenticated n8n user builds a workflow using the Git node pointed at a hostile repository and configures a clone destination that passes path validation. In a tight loop, they win the TOCTOU race by swapping the validated directory for a symlink after the check but before the clone, causing the malicious repo to land in the community node directory; when n8n next restarts, it loads the planted node and executes the attacker's JavaScript on the server. No public POC is currently identified, and the race window plus AC:H means several attempts may be needed.