Medium severity6.5NVD Advisory· Published Aug 11, 2026· Updated Sep 1, 2026
CVE-2026-72770
CVE-2026-72770
Description
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at local paths outside the sandbox to pull arbitrary git repositories and read their files and history.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/n8n-io/n8n/security/advisories/GHSA-gf29-4f56-r2jfnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/n8n-before-path-traversal-via-git-node-operationsnvdThird Party Advisory
News mentions
1- N8n: 16 Vulnerabilities Including RCE and SQLi Disclosed in Single BatchVypr Intelligence · Aug 11, 2026