CVE-2026-72767: n8n

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.

Affected products

• n8n n8n: before 1.123.67 (fixed in 1.123.67); from 2.0.0, before 2.31.5 (fixed in 2.31.5); version 2.32.0 only

Published 2026-08-11. Last modified 2026-09-18.