CVEvulnerability

CVE-2026-44790

9.4 CRITICAL Published 2026-06-23 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-06-23
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.4 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88

Description

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

Affected configurations

• n8n n8n (< 1.123.43) • n8n n8n (>= 2.0.0 < 2.20.7) • n8n n8n (>= 2.21.0 < 2.22.1)

Related

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References