SSH Command Vulnerability in n8n Workflow Automation Platform

CVE-2026-33724

What is CVE-2026-33724?

The n8n workflow automation platform has a vulnerability where configuring the Source Control feature to use SSH could lead to significant security risks. Specifically, prior to version 2.5.0, the SSH command employed for git operations did not verify host keys, allowing potential man-in-the-middle attacks. Malicious actors could exploit this by intercepting connections to the remote Git server, presenting a fraudulent host key, and injecting harmful content into workflows or stealing repository data. Users should upgrade to n8n version 2.5.0 or later to fully secure their systems. In the interim, it is advisable to disable the Source Control feature if not essential or limit network access to ensure secure communication paths to the Git server.

References