n8n CVE-2026-71539

Exploitation requires: (1) a valid n8n user account with at minimum workflow creation and execution permissions (PR:L confirmed by CVSS vector); (2) the Git node must not be excluded via the NODES_EXCLUDE environment variable - it is available by default; (3) the attacker must win a filesystem TOCTOU race window (AC:H/AT:P - high complexity with a specific attack precondition), which may require repeated attempts or scripted timing; (4) a subsequent n8n server restart must occur for the planted node to be loaded and executed, either triggered by the attacker or occurring naturally. Exploitation is limited by: the authentication requirement (unauthenticated exploitation is not possible), the race condition timing complexity which may reduce reliability, and the restart dependency which introduces a delay between exploitation and code execution. There is no requirement for admin-level privileges, special OS configuration, or non-default n8n settings beyond the Git node being available.

The CVSS 4.0 score of 8.9 (AV:N/AC:H/AT:P/PR:L/UI:N) correctly reflects that exploitation is non-trivial: AC:H and AT:P acknowledge the race condition timing requirement and prerequisite conditions, specifically that the Git node must be available and the attacker must be able to create and execute workflows. PR:L confirms that a low-privileged authenticated session is sufficient - no admin account needed. The subsequent-system confidentiality impact is rated SC:H, reflecting that arbitrary server-side code execution can pivot beyond n8n itself to host credentials, internal network services, and connected data stores. There is no CISA KEV listing and no public exploit code identified at time of analysis, which moderates immediate exploitation urgency. However, TOCTOU conditions in web applications are frequently exploited once a proof-of-concept is developed, and the payoff - full server RCE - is high enough to attract motivated threat actors. The realistic attacker profile is an insider or a user account obtained via credential compromise. For organizations running n8n with untrusted or externally-accessible user bases, this should be treated as a high priority.

An attacker with a valid n8n user account (obtained via credential stuffing, phishing, or insider access) creates a workflow containing a Git node configured to clone a repository they control. They trigger the workflow, and concurrently monitor or script the filesystem race window between path validation and clone execution, swapping the target directory for a symlink pointing to n8n's community node directory. The clone deposits a crafted package.json and malicious JavaScript file there. On the next n8n restart - either triggered naturally or forced by the attacker via another API call - n8n loads the planted code as a trusted custom node and executes it in the server process context, granting the attacker full server-side code execution.