PT-2026-22005 · N8N · N8N

Fatihhcelik · Published 2026-02-25 · Updated 2026-03-04 · CVE-2026-27498

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.2.0 n8n versions prior to 1.123.8

Description n8n is an open source workflow automation platform. An authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, an attacker could execute arbitrary shell commands on the n8n host. The issue involves the interaction between the Read/Write Files from Disk node and git operations, potentially allowing an attacker to manipulate configuration files and subsequently execute commands. The Read/Write Files from Disk node and git operations are involved in the exploitation process.

Recommendations Upgrade to n8n version 2.2.0 or later. Upgrade to n8n version 1.123.8 or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only. If upgrading is not immediately possible, disable the Read/Write Files from Disk node by adding n8n-nodes-base.readWriteFile to the NODES EXCLUDE environment variable.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-05052

CVE-2026-27498

GHSA-X2MW-7J39-93XQ

Affected Products

N8N

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27498.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32 · Patch
• https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866 · Patch
• https://osv.dev/vulnerability/GHSA-x2mw-7j39-93xq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27498 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27498 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05052 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/%20n8n@2.2.0 · Note
• https://github.com/n8n-io/n8n/releases/tag/%20n8n@1.123.8 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0 · Note
• https://twitter.com/VulmonFeeds/status/2026816842375795143 · Twitter Post
• https://twitter.com/CVEnew/status/2027004270260703464 · Twitter Post