Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33724 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in N8N N8N. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33724 affects n8n, an open source workflow automation platform, in versions prior to 2.5.0. The vulnerability arises in the Source Control feature when explicitly configured to use SSH for Git operations. In this setup, the SSH command explicitly disables host key verification, enabling a man-in-the-middle (MITM) attack where a network adversary could intercept the connection between the n8n instance and the remote Git server.
A remote network attacker positioned between the n8n instance and the Git server can exploit this by presenting a fraudulent host key. Successful exploitation allows the attacker to inject malicious content into workflows or intercept repository data, leading to high confidentiality and integrity impacts without requiring privileges or user interaction. The CVSS v3.1 base score of 7.4 reflects network accessibility but high attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), and it maps to CWE-639 (Authorization Bypass Through User-Controlled Key).
The n8n security advisory (GHSA-43v7-fp2v-68f6) confirms the issue is fixed in version 2.5.0, recommending immediate upgrades to this or later versions. For temporary mitigations where upgrading is not feasible, administrators should disable the Source Control feature if not required or restrict network access to ensure communication occurs only over trusted paths; these are short-term measures and do not fully eliminate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15954
Vulnerability Data
n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the…
more
n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable the Source Control feature if it is not actively required, and/or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.
Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.
Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing authorization checks but does not prevent the weakness in production.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes authorization design but does not itself implement runtime access checks.