CVE-2026-92588: n8n before 1.123.76 Improper Authorization via Source Control Push
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Only deployments using the licensed Source Control (Environments) enterprise feature are exposed, and that feature must be enabled and connected to a remote repository. An affected n8n version alone is not sufficient.
What level of access does an attacker need?
An attacker must be authenticated as a project-scoped user, such as a project admin. They can exploit the issue by submitting client-supplied file paths and status that reference projects they are not authorized to access.
What is the practical impact?
The attacker can push deletions of workflows and credentials belonging to other projects. The described impact is cross-project data destruction; no confidentiality or availability impact is stated.
Which versions remediate the issue?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, as appropriate for the deployed release line. Versions before those releases are affected.