Which versions of N8n are affected by EUVD-2026-15954?

Organizations using n8n should be aware of moderate risk from CVE-2026-33724, a IDOR vulnerability rated CVSS 6.3. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-15954?

Yes, a public proof-of-concept exploit is available for EUVD-2026-15954. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-15954?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

N8n EUVD-2026-15954

Q: What is the CVSS score of EUVD-2026-15954?

EUVD-2026-15954 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33724 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-25 GitHub_M

GHSA-43v7-fp2v-68f6

Authentication Bypass N8n

6.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 27, 2026 - 19:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 18:47 euvd

EUVD-2026-15954

Analysis Generated

Mar 25, 2026 - 18:47 vuln.today

CVE Published

Mar 25, 2026 - 18:26 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable the Source Control feature if it is not actively required, and/or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allows network-positioned attackers to perform man-in-the-middle attacks against Git operations. Affected users who have explicitly enabled and configured SSH-based source control can have their workflows injected with malicious content or have repository data intercepted without authentication. While the feature is non-default and requires explicit configuration, the vulnerability enables complete compromise of workflow integrity and potential lateral movement within automation pipelines.

Technical ContextAI

The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where n8n's SSH git client implementation explicitly disables host key verification during git operations. SSH host key verification is a critical authentication mechanism that prevents man-in-the-middle attacks by verifying the identity of the remote Git server through cryptographic validation. When disabled, the SSH client accepts connections from any server presenting itself with the repository hostname, bypassing the entire security model of SSH public key infrastructure. This affects the n8n-io:n8n product (all versions before 2.5.0) as identified via CPE cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:*, specifically impacting users who have enabled the Source Control feature with SSH configuration.

RemediationAI

Upgrade n8n to version 2.5.0 or later to remediate the vulnerability. See the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6 for detailed patching instructions. As interim mitigations prior to upgrading, disable the Source Control feature entirely if it is not actively required for operations, and restrict outbound network access from n8n instances to ensure Git server communications traverse only trusted, controlled network paths (dedicated VPNs, private network links, or segmented firewall rules). Implement network segmentation to prevent untrusted clients from intercepting Git operations. These mitigations are temporary and do not eliminate the underlying vulnerability; patching is the definitive remediation.