CVE-2026-72767 is a remote code execution vulnerability in the Git node of n8n. It affects versions prior to 1.123.67, 2.x prior to 2.31.5, and 2.32.x prior to 2.32.1. The flaw arises because git hooks run under default git security settings, allowing an authenticated user with workflow creation and execution privileges to stage a malicious local repository that causes arbitrary OS commands to be executed with the privileges of the n8n process user.

Successful exploitation allows an authenticated user to execute arbitrary commands on the underlying operating system with the permissions of the n8n process user. This can lead to full compromise of the affected system, data theft, or further lateral movement within the environment. Both self-hosted and cloud instances are vulnerable, though cloud remediation status is not specified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workflow creation and execution permissions to trusted users only. Monitor for unusual git hook activity and consider disabling or sandboxing git hooks if possible.