CVE-2026-72770

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67

Description A path traversal issue exists in the Git node during fetch, pull, and push-tags operations. This allows authenticated users with workflow creation or execution privileges to bypass repository-path containment checks. By pointing allowlisted remote configurations to local paths outside the sandbox, an attacker can pull arbitrary git repositories and access their files and history.

Recommendations Update n8n to version 1.123.67 or later.