Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-d763-b5fk-g3dm
Vulnerability ID VCID-d763-b5fk-g3dm
Aliases CVE-2026-33724
GHSA-43v7-fp2v-68f6
Summary n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable the Source Control feature if it is not actively required, and/or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-33724
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-33724
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-43v7-fp2v-68f6
cvssv3.1 5.4 https://github.com/n8n-io/n8n
cvssv4 6.3 https://github.com/n8n-io/n8n
generic_textual MODERATE https://github.com/n8n-io/n8n
cvssv3.1 5.4 https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
cvssv3.1_qr MODERATE https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
cvssv4 6.3 https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
generic_textual MODERATE https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
ssvc Track https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2026-33724
cvssv4 6.3 https://nvd.nist.gov/vuln/detail/CVE-2026-33724
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-33724
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-33724
https://github.com/n8n-io/n8n
https://nvd.nist.gov/vuln/detail/CVE-2026-33724
GHSA-43v7-fp2v-68f6 https://github.com/advisories/GHSA-43v7-fp2v-68f6
GHSA-43v7-fp2v-68f6 https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/n8n-io/n8n
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/n8n-io/n8n
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-25T20:05:11Z/ Found at https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-33724
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-33724
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.04367
EPSS Score 0.00017
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:49:38.647422+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33724.json 38.6.0