n8n, an open source workflow automation platform, was found to disable SSH host key verification when the Source Control feature is set to use SSH. This configuration allows a network attacker positioned between the n8n instance and the remote Git server to perform a man‑in‑the‑middle attack, presenting a fraudulent host key and thereby injecting malicious content into pulled workflows or intercepting repository data. The vulnerability can be exploited by any adversary able to observe or manipulate the network traffic to the Git server, potentially leading to unauthorized code execution or data exfiltration.

The issue affects all deployments of n8n-io's n8n platform that enable the Source Control feature with SSH prior to version 2.5.0. Earlier releases before 2.5.0 are vulnerable, while versions 2.5.0 and later have the fix applied. Administrators should verify the version of n8n installed to determine exposure.

The CVSS score of 6.3 indicates a moderate severity, but the EPSS score of less than 1% suggests low exploitation likelihood in the wild. The vulnerability is not listed in CISA's KEV catalog, reducing immediate threat visibility. Exploitation requires a network attacker capable of intercepting traffic between the n8n instance and the Git server, implying that the attack vector is primarily network-based MITM. Despite the low EPSS, the potential for code injection warrants prompt action.