EUVD-2026-81288
GHSA-cr47-hhfm-v884
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint (AV:N) exploitable by a project-admin account (PR:H) with no user interaction; integrity-only cross-project deletion (I:H), no confidentiality or availability impact; scope unchanged within n8n.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.
AnalysisAI
Improper authorization in the n8n source control push endpoint (versions before 1.123.76, 2.37.7, and 2.38.2) allows an authenticated, project-scoped privileged user such as a project admin to reference files outside their own projects and push deletions of other projects' workflows and credentials, causing cross-project data destruction. Exploitation is gated: the Source Control (Environments) enterprise feature must be licensed, enabled, and connected to a remote repository, and the attacker must already hold a privileged in-app account (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N; CVSS 4.0 base 5.9, integrity-only with PR:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) the Source Control (Environments) enterprise feature is licensed on the n8n instance, (2) it is enabled and connected to a remote repository, and (3) the attacker holds an authenticated project-scoped privileged account such as a project admin (PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, matching the release line you run, per the GitHub advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-hvrx-jc5j-pg3w and the VulnCheck advisory at https://www.vulncheck.com/advisories/n8n-before-1.123.76-improper-authorization-via-source-control-push. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Share
External POC / Exploit Code
Leaving vuln.today