n8n Git Node Sandbox Bypass via branch.<name>.remote Config Injection
First seen Sep 13, 2026 · Updated Sep 13, 2026
A vulnerability in n8n's Git node allowed an authenticated workflow-editor to bypass repository path validation by writing an arbitrary remote value into a repository's git config via setUpstream, then triggering a fetch/pull that reads from that unvalidated remote instead of the checked parameter. This let an attacker with workflow-edit permissions exfiltrate contents of any local git repository readable by the n8n process. The issue has been patched in current n8n releases.
Technical Analysis
The Git node in n8n validates the repository parameter passed to fetch/pull operations, but the setUpstream operation writes a branch.<name>.remote entry directly into the target repository's .git/config without applying the same validation. Because subsequent fetch/pull operations resolve the remote from this stored config value rather than re-validating the original parameter, an attacker can set the remote to point at an arbitrary local path on the host filesystem. This effectively acts as a sandbox/path-restriction bypass, allowing the workflow (and thus any user with edit permission on that workflow) to read the contents of other local git repositories accessible to the n8n process, crossing the intended tool-permission boundary between 'operate on this designated repo' and 'read arbitrary local repos'. The entry point is the Git node's exposed configuration operations within a workflow, and the impact is scoped to local filesystem/git-repo disclosure rather than remote code execution.
Affected Systems
n8n
Detection Signatures
- Workflow definitions containing Git node 'setUpstream' operations followed by fetch/pull steps
- Git node configurations referencing unexpected or attacker-controlled local file paths as repository targets
- Unexpected changes to branch.<name>.remote entries in .git/config files on the n8n host
- Audit logs showing workflow edits to Git node parameters by low-trust users followed by fetch/pull execution
- n8n process reading git repositories outside its designated working directory
Remediation Steps
- 1
Upgrade n8n
Update to n8n 1.123.76, 2.37.7, 2.38.2, or later, which validate the branch remote configuration on the same terms as the repository parameter.
- 2
Restrict workflow-edit permissions
Limit who can create or edit workflows containing Git nodes to fully trusted users until patched.
- 3
Disable the Git node if unused
Add n8n-nodes-base.git to the NODES_EXCLUDE environment variable to remove the vulnerable functionality entirely.
- 4
Run n8n with least privilege
Execute the n8n process under a dedicated low-privilege OS account to limit which local repositories/files could be read if exploited.
- 5
Audit git config changes
Monitor for unexpected modifications to branch remote settings in repositories accessible to the n8n host.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.