CVE-2026-49465— n8n: Git Node Clone and Push Operations Bypass File Sandbox
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1005 · Data from Local System T1083 · File and Directory DiscoveryGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Source: NVD (National Vulnerability Database)
Vulnerability Description
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
n8n 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
n8n是n8n公司开源的一个可扩展的工作流自动化工具。 n8n 1.123.48之前版本、2.21.8之前版本和2.22.4之前版本存在路径遍历漏洞，该漏洞源于在Git节点的Clone操作或Push操作中允许用户提供本地文件系统路径，从而绕过N8N_RESTRICT_FILE_ACCESS_TO文件沙箱，可能导致经身份验证的攻击者读取本地Git仓库内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-49465
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49465
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49465 (1)
Same Patch Batch · n8n-io · 2026-06-23 · 21 CVEs total
| CVE-2026-54302 | n8n: Stored XSS in Chat Trigger Node | |
| CVE-2026-44791 | n8n: XML Node Prototype Pollution Patch Bypass | |
| CVE-2026-44789 | n8n: HTTP Request Node Pagination Prototype Pollution to RCE | |
| CVE-2026-44792 | n8n: Source Control Pull SQL Injection | |
| CVE-2026-44790 | n8n: Arbitrary File Read via Git Node | |
| CVE-2026-49444 | n8n: Python sandbox escape | |
| CVE-2026-54304 | n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host | |
| CVE-2026-54301 | n8n: Same-Origin XSS in Respond to Webhook Node | |
| CVE-2026-54310 | n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes | |
| CVE-2026-54314 | n8n: Denial of Service via ZIP decompression in webhook workflow | |
| CVE-2026-45732 | n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints | |
| CVE-2026-54306 | n8n: Prototype Pollution enables confused-deputy execution via public webhooks | |
| CVE-2026-54313 | n8n: NoSQL Injection in MongoDB Node Find And Replace Operation | |
| CVE-2026-54303 | n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verificatio | |
| CVE-2026-54305 | n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints | |
| CVE-2026-54307 | n8n: Credential Exfiltration via Permission Bypass | |
| CVE-2026-54308 | n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node | |
| CVE-2026-54312 | n8n: Microsoft SQL Node Prototype Pollution | |
| CVE-2026-54309 | n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions | |
| CVE-2026-54311 | n8n: Merge Node SQL Mode Prototype Pollution |
IV. Related Vulnerabilities
Same product: n8n
- CVE-2026-59259
n8n - Permission Bypass via Expression Parser Mismatch in Ex - CVE-2026-59254
n8n - External Secrets Disclosure via Workflow Node Expressi - CVE-2026-56353
n8n - Authentication Bypass in Chat Trigger Node - CVE-2026-56352
n8n - Arbitrary File Read and Execution via ExecuteWorkflow - CVE-2026-56349
n8n - Guardrail Node Bypass via Crafted Input
Same vendor: n8n-io
- CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-59206
n8n: Prototype Pollution via Workflow Credentials Leads to U - CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject - CVE-2026-59207
n8n: "Allowed HTTP Request Domains" Restriction Bypass via A - CVE-2026-44792
n8n: Source Control Pull SQL Injection
Same weakness: CWE-22
- CVE-2026-44177
Kirby: Pre-authentication path traversal and PHP file inclus - CVE-2026-44023
Docling Core has unsafe remote filename resolution - CVE-2026-55629
Whistle: Path traversal - CVE-2026-53535
Activepieces: Arbitrary file write in git-sync via path trav - CVE-2026-46338
PyMdown Extensions: Regression in pymdownx.snippets reintrod
V. Comments for CVE-2026-49465
No comments yet