Which versions of n8n are affected by EUVD-2026-56093?

n8n deployments running versions 1.x before 1.123.67, 2.x before 2.31.5, or 2.32.x before 2.32.1 expose authenticated users to execute arbitrary commands on underlying servers-a high-severity risk…. A patch is available.

How to fix or mitigate EUVD-2026-56093?

Within 24 hours, identify all n8n deployments currently running affected versions (1.x < 1.123.67, 2.x < 2.31.5, 2.32.x < 2.32.1) and determine whether untrusted users possess workflow creation or execution rights. Within 7 days, upgrade all instances to patched versions: n8n v1.123.67 or later for 1.x deployments, v2.31.5 or later for 2.x deployments, and v2.32.1 or later for 2.32.x deployments, prioritizing production and customer-facing systems first. Within 30 days, establish role-based access controls limiting Git node and workflow creation to trusted administrators, audit the activity log for suspicious workflow executions, and confirm patch deployment across all environments including development, staging, and production.

n8n EUVD-2026-56093

Q: What is the CVSS score of EUVD-2026-56093?

EUVD-2026-56093 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-72767 HIGH

OS Command Injection (CWE-78)

2026-08-11 VulnCheck

GHSA-rvvp-8h68-7hqm

RCE Command Injection N8n N8N Io

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible Git node invoked by low-privileged authenticated workflow users; full C/I/A from OS-level RCE; scope unchanged as execution is confined to the n8n process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 12:51 vuln.today

Analysis Generated

Aug 11, 2026 - 12:51 vuln.today

CVE Published

Aug 11, 2026 - 12:17 cve.org

HIGH 8.7

DescriptionCVE.org

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.

AnalysisAI

Remote code execution in n8n's Git node allows authenticated users with workflow creation and execution rights to run arbitrary OS commands as the n8n process user by staging a crafted repository that triggers git hook execution under default git security settings. All 1.x versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 are affected across both self-hosted and cloud deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity attack path and broad version coverage make this a high-priority patch for any deployment permitting untrusted authenticated users.

Technical ContextAI

n8n is an open-source workflow automation platform distributed as the npm package n8n-io/n8n. It exposes a 'Git node' that invokes the system git binary from within user-defined workflows. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection): the Git node passes attacker-controlled repository paths to the git binary without disabling hook execution or hardening git's safe.directory controls. Under git's default security posture, processing a repository automatically executes any hooks present (e.g., post-checkout, pre-commit), which run as the OS user owning the n8n process. This is not a git vulnerability - it is n8n's failure to invoke git in a restricted mode (e.g., via --no-hooks or git config core.hooksPath /dev/null) when handling user-supplied inputs. CPE: cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched release immediately: n8n 1.123.67 for all 1.x deployments, 2.31.5 for 2.x deployments below 2.32, or 2.32.1 for 2.32.x deployments. The fix commit is available at https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f and the full advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-rcv6-pvrj-4xcg. If immediate upgrade is operationally blocked, three specific workarounds are documented by the vendor, each with trade-offs: (1) Restrict instance access to fully trusted users only - eliminates the threat but may not be feasible in multi-tenant or collaborative deployments; (2) Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable - fully removes the attack surface with zero residual risk from this CVE, but will break any existing workflows that depend on the Git node; (3) Restrict network egress from the n8n host - limits blast radius by preventing reverse-shell callbacks and data exfiltration, but does not prevent code execution itself. The vendor explicitly states all workarounds are short-term measures only and do not fully remediate the risk.