PT-2026-40934

CVE-2026-44790

Published

2026-05-14

Updated

2026-10-06

Description by

CVSS 4.0

9.4

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.43 n8n versions prior to 2.20.7 n8n versions prior to 2.22.1

Description An authenticated user with permissions to create or modify workflows can inject CLI flags during the Push operation of the Git node. This allows the attacker to read arbitrary files from the server, which can lead to a full system compromise and server-level remote code execution (RCE) by breaking sandboxes.

Recommendations Update to version 1.123.43 or later. Update to version 2.20.7 or later. Update to version 2.22.1 or later. Limit workflow creation and editing permissions to fully trusted users only. Disable the Git node by adding n8n-nodes-base.git to the NODES EXCLUDE environment variable.

Exploitability

Exploit

Fix

Impacts

Researchers

Simonkoeck

Vendors

Affected products

Weakness enumeration

CWE-88: Improper Neutralization of Argument Delimiters in a Command (\'Argument Injection\')

Related identifiers

CVE-2026-44790