SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-86995

MEDIUM · CVSS 4.3 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-11

CyberRota Analysis

AI-Generated

The Git node in n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 is vulnerable due to improper validation of the repository parameter, allowing an authenticated workflow editor to access any local repository readable by the n8n process. This could lead to unauthorized data exposure through the fetching of sensitive repository contents. Organizations using affected versions of n8n should prioritize upgrading to the patched versions to mitigate potential data leaks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86995
Severity
MEDIUM
CVSS
4.3
EPSS
0.28%

Original NVD Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Related CVEs

Other vulnerabilities affecting the same vendor(s)