PT-2026-28085 · N8N · N8N
Publicado
2026-03-25
·
Atualizado
2026-03-26
·
CVE-2026-33724
CVSS v3.1
7.4
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 2.5.0
Description
n8n is a workflow automation platform. When the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The attack involves a man-in-the-middle position to intercept communication between the n8n instance and the Git server.
Recommendations
Versions prior to 2.5.0 should be upgraded to version 2.5.0 or later.
If upgrading is not immediately possible, disable the Source Control feature if it is not actively required.
If upgrading is not immediately possible, restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths.
Exploit
Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
N8N