CVE-2026-44790: n8n: Arbitrary File Read via Git Node

Synopsis

This is a CLI argument injection vulnerability in n8n, an open-source workflow automation platform. An authenticated user who has permission to create or modify workflows can inject extra command-line flags into the Git node's Push operation, causing the n8n server to read and expose arbitrary files from its own filesystem. Successful exploitation gives the attacker access to any file readable by the n8n process, and the high scores across confidentiality, integrity, and availability in the CVSS vector indicate this can lead to full server compromise. No fix versions have been published upstream yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the n8n web interface or API over the network; the service exposes HTTP endpoints that are the entry point for exploitation.

• AuthenticationRequired

  A valid account with permission to create or edit workflows is needed, though any low-privilege account granted that permission is sufficient.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker triggers the vulnerable Git Push operation directly through their own session.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Reads arbitrary files from the n8n server filesystem, including credential stores, environment variable files, and private SSH keys used by the application.
• Modifies or exfiltrates workflow definitions and stored secrets, enabling an attacker to pivot to connected third-party services integrated into n8n workflows.
• Compromises systems downstream of n8n by leveraging harvested credentials or API tokens to authenticate against external services the workflows interact with.
• Disrupts n8n service availability through manipulation of configuration files or by exhausting server resources during bulk file reads.