CVE-2026-65598: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

The Git node's clone operation checks the target path, then clones. Between the check and the clone, an attacker swaps a directory for a symlink. This is a time-of-check to time-of-use race (CWE-367). The clone then lands in the community node directory instead of the allowed location.

n8n loads community nodes from that directory when it restarts. Nodes are JavaScript, so the planted repository runs as code inside the n8n process. The attacker needs an account that can create and run workflows with the Git node, plus a git repository they control that the instance can reach. The CVSS 4.0 vector marks attack complexity high, because the race must be won, and privileges low.

Both self-hosted and cloud instances are in scope. The result is arbitrary code execution as the n8n service. That exposes stored credentials, workflow data and anything the host can reach. The code runs after a restart, so it can be delayed. The advisory gives no proof of concept.

Affected: n8n below 1.123.64 on the 1.x line, 2.0.0-rc.0 up to but not including 2.29.8, and 2.30.0. Any instance where users other than fully trusted admins can build workflows that use the Git node is exposed.

Check the version:

npm ls n8n

For Docker, check the image tag or the version shown in the UI.

Upgrade to n8n 1.123.64, 2.29.8 or 2.30.1, or later. For an npm install, run npm install [email protected].

Temporary mitigations from the advisory, none of which fully remove the risk:

• Restrict instance access to fully trusted users.
• Add n8n-nodes-base.git to the NODES_EXCLUDE environment variable to disable the Git node.
• Restrict network egress from the n8n instance so it cannot reach attacker-controlled git repositories.

Inspect the community node directory of your n8n install for packages or repositories you did not install, especially ones with recent timestamps. Review workflows and execution history for Git node clone operations that target unusual paths or untrusted repository URLs. Check egress logs for connections to unfamiliar git hosts. Look for unexpected restarts of the n8n process, since the planted code loads on restart. Any unknown custom node should be treated as a compromise of the host.

Impact

A TOCTOU race condition in the Git node's clone operation lets an authenticated user bypass its path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This plants a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, and since nodes execute JavaScript, this yields arbitrary code execution on the server.

Both self-hosted and cloud instances are affected, where authenticated users can create and run workflows using the Git node.

Patches

Users should upgrade to the patched version once available to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable.
• Restrict network egress from the n8n instance to prevent connections to attacker-controlled git repositories.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.