CVE-2026-92588

Overview

In n8n versions prior to 1.123.76, 2.37.7, and 2.38.2, the source‑control push endpoint incorrectly used client‑supplied file paths to determine which files to push. An authenticated project‑scoped user could delete workflows and credentials from projects they do not own, causing cross‑project data loss.

Description

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.

Impact

Project administrators can delete workflows and credentials in other projects, resulting in integrity compromise and availability disruption. Confidentiality is not directly affected, but the loss of credentials can indirectly expose sensitive data.

Remediation

['Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 (or later) to apply the fix.', 'If upgrading is not immediately possible, disable the Source Control (Environments) feature or restrict its use to trusted users.', 'Implement least‑privilege access controls for project‑scoped users and audit deletion operations.', 'Monitor logs for unexpected delete operations and set alerts on workflow or credential deletions.']

Risk context

The vulnerability has a medium CVSS score (v3 4.4, v4 5.9) and requires the enterprise Source Control feature to be enabled. While it does not allow arbitrary code execution, it enables destructive actions that can erase critical automation assets, warranting timely patching or feature restriction.

Affected products

• n8n Workflow Automation Platform
• n8n Enterprise (Source Control / Environments feature)