n8n CVE-2026-72773

Exploitation requires three conditions to be simultaneously true. First, the actor must hold a low-privileged authenticated account on the n8n instance, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated external attackers cannot exploit this directly. Second, the targeted n8n deployment must have AI agent workflows configured that use the @n8n/computer-use package with the search_files tool active; this is a non-default component not present in standard n8n installations, and the AT:P in the CVSS 4.0 vector explicitly captures this prerequisite. Third, the actor must be able to control or influence the search pattern input passed to the search_files tool within such a workflow. Exploitation impact is further bounded by the OS-level read permissions of the n8n daemon's process account; running n8n under a dedicated low-privilege user with restricted home directory access materially limits accessible file paths even if the confinement bypass succeeds.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N) produces a score of 4.9 (Medium), with the high subsequent-system confidentiality impact (SC:H) as the sole driver - reflecting the cross-boundary arbitrary file read - offset by the AT:P (Attack Requirements: Present) constraint. That AT:P metric is the critical limiting factor: the @n8n/computer-use package and an AI agent workflow using search_files must both be deployed and accessible, which is not a default configuration. PR:L confirms that some authenticated access to the n8n instance is required, ruling out unauthenticated external exploitation. No CISA KEV listing exists and no public proof-of-concept has been identified, further reducing operational urgency relative to actively-exploited path traversal flaws. However, the gap between the modest numeric score and the real-world impact (SC:H equates to reading arbitrary host files) is meaningful in multi-tenant or SaaS-style n8n instances: a low-privileged user could pivot to read database credentials, API keys, or other secrets stored on the host, making this a credible lateral-movement vector. Prioritization should be driven by whether computer-use AI workflows are active in a given deployment.

An authenticated n8n user with low privileges locates an AI agent workflow in the instance that exposes the computer-use search_files tool. The attacker submits a crafted search pattern - for example a glob expression containing relative traversal components - that circumvents the base-directory confinement check and resolves to paths on the host filesystem. The tool returns file names and contents from outside the sandbox, such as n8n's own .env file containing database connection strings or third-party API keys, which the attacker harvests for further account compromise or lateral movement. No public proof-of-concept code has been identified, but path traversal via crafted glob patterns is a well-understood and straightforward attack primitive.