n8n: Git Node Clone and Push Operations Bypass File Sandbox
- Product
- n8n
- CVE
- CVE-2026-49465
- Affected
- npm/n8n < 1.123.48, >= 2.0.0-rc.0 < 2.21.8, >= 2.22.0 < 2.22.4
- Fixed in
- 1.123.48
Last verified against sources: October 26, 2026
Am I affected?
n8n: affected npm/n8n < 1.123.48, >= 2.0.0-rc.0 < 2.21.8, >= 2.22.0 < 2.22.4. Fixed in 1.123.48.
- Check your version: run
npm ls n8n. Versions < 1.123.48 of n8n are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install n8n@1.123.48(first patched version 1.123.48). [1] - Upgrade to one of these versions or later to remediate the vulnerability. [1]
- Limit workflow creation and editing permissions to fully trusted users only. [1]
- Disable the Git node by adding
n8n-nodes-base.gitto theNODES_EXCLUDEenvironment variable. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the
N8N_RESTRICT_FILE_ACCESS_TOfile sandbox. [1]
Impact
- This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. [1]
What was done
Sources
- GHSA-5xp3-2w67-427v — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-49465] n8n: Git Node Clone and Push Operations Bypass File Sandbox
Product: n8n | Affected: npm/n8n < 1.123.48, >= 2.0.0-rc.0 < 2.21.8, >= 2.22.0 < 2.22.4 | Fixed in: 1.123.48
Summary: An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the `N8N_RESTRICT_FILE_ACCESS_TO` file sandbox.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/06/cve-2026-49465-n8nCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-49465
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.