CVE-2026-86995: 
NixOS vulnerability analysis and mitigation

CVE-2026-86995 is a file disclosure vulnerability in the Git node of n8n, an open-source workflow automation platform, titled "Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read." An authenticated workflow editor can exploit this flaw to redirect Git operations to any local repository readable by the n8n process, thereby exfiltrating its contents. The vulnerability was published on September 2, 2026, and affects n8n versions prior to 1.123.76, versions 2.0.0 through 2.37.6, and versions 2.38.0 through 2.38.1. It carries a CVSS v4 base score of 5.3 (Medium) and a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, n8n Security Advisory).

The root cause is an inconsistent input validation pattern (CWE-22: Path Traversal; CWE-73: External Control of File Name or Path) in packages/nodes-base/nodes/Git/GenericFunctions.ts. The Git node correctly validates the repository parameter when performing fetch or pull operations, but the setUpstream function writes a branch.<name>.remote value directly into the repository's Git configuration without applying the same validation. When a subsequent fetch or pull is executed, Git resolves the remote from this unvalidated configuration entry rather than from the checked parameter, effectively bypassing the sandbox path restriction. An attacker must be an authenticated user with workflow-edit permissions to trigger this two-step exploitation sequence (GitHub Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated workflow editor to read the contents of any local Git repository accessible to the n8n process, resulting in unauthorized disclosure of potentially sensitive source code, credentials, configuration files, or other data stored in those repositories. There is no integrity or availability impact; the vulnerability is limited to confidentiality. The scope of exposure is bounded by the filesystem permissions of the n8n process account, meaning a highly privileged n8n process could expose a broader range of repositories (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.323%, placing it in the 25th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with workflow-edit permissions, which limits the attacker pool but does not eliminate risk in multi-tenant or shared n8n deployments (GitHub Advisory).

1. Gain authenticated access: Obtain credentials for an n8n account with workflow-edit permissions — this could be through a legitimate account, compromised credentials, or a free/trial account on a shared instance.
2. Create or modify a workflow: Open the n8n workflow editor and add or modify a workflow that includes a Git node.
3. Invoke setUpstream with a malicious remote path: Configure the Git node to call the setUpstream operation, supplying a crafted branch.<name>.remote value that points to a target local repository path (e.g., /etc/, /home/n8n/.ssh/, or another sensitive directory managed as a Git repo) readable by the n8n process. This value is written into the repository's Git configuration without validation.
4. Trigger a fetch or pull: Execute a subsequent fetch or pull operation in the same workflow. Git resolves the remote from the unvalidated configuration entry written in the previous step rather than from the checked parameter.
5. Receive repository contents: The Git node returns the contents of the targeted local repository through the workflow output, exposing source code, secrets, or configuration files to the attacker (n8n Security Advisory, GitHub Advisory).

• Logs: n8n workflow execution logs showing Git node operations (fetch/pull) targeting unexpected or local filesystem paths; audit logs recording setUpstream calls followed immediately by fetch/pull operations from the same workflow.
• File System: Unexpected modifications to .git/config files within repositories accessible to the n8n process, specifically new or altered branch.<name>.remote entries pointing to local paths rather than remote URLs.
• Network: Absence of outbound network connections during Git fetch/pull operations that would normally contact a remote server — indicating the remote was resolved locally rather than over the network.
• Process: n8n process accessing Git repositories outside of expected working directories, observable via filesystem audit tools (e.g., auditd on Linux) or process monitoring (n8n Security Advisory).

Upgrade n8n to one of the patched versions: 1.123.76, 2.37.7, or 2.38.2, which validate the branch.<name>.remote configuration on the same terms as the repository parameter (n8n Security Advisory, Release 1.123.76, Release 2.37.7, Release 2.38.2). If immediate upgrade is not possible, apply the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable.
• Run the n8n process under a dedicated low-privilege OS user account to minimize the filesystem scope accessible to the process.

These workarounds do not fully remediate the risk and should only be used as short-term measures (GitHub Advisory).