CVE-2026-77068 n8n-io CVE debrief

Who should care

Users of n8n versions before 2.33.4 and 2.34.x before 2.34.1, especially those with global:member privileges, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing n8n deployments, restricting global:member privileges, and implementing compensating controls such as web application firewalls. Security teams should monitor for suspicious activity and exception tracking, and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Affected operators, platforms, and vulnerability-management teams should prioritize remediation based on the HIGH CVSS score of 8.7 and potential operational impact. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets to ensure thorough mitigation and documentation of evidence for closure. This vulnerability's impact extends to n8n users with deployment and configuration responsibilities, requiring coordinated review and action across development, operations, and security teams to ensure comprehensive mitigation and minimize potential disruption to services and data integrity. The vulnerability's remote code execution nature and the relatively high CVSS score underscore the urgency for affected users to assess their exposure and implement protective measures promptly, ideally before exploitation occurs in their environments, and to verify the effectiveness of implemented controls through thorough testing and validation processes to safeguard against potential attacks and data breaches effectively within their n8n deployments and associated systems and networks. Therefore, immediate attention and proactive measures are crucial for maintaining the security and integrity of n8n-based workflows and related infrastructure components across the organization, and for ensuring the resilience of critical business processes and services that depend on n8n for automation and workflow management, especially in environments where global:member privileges are prevalent or where the n8n platform is integrated with other critical systems and data,

Technical summary

The @n8n/workflow-sdk node-schema loader in n8n before 2.33.4 and 2.34.x before 2.34.1 has a remote code execution vulnerability. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. This allows an authenticated user with global:member privileges to reference malicious files via path traversal, causing code execution in the n8n main process.

Defensive priority

Authenticated users with global:member privileges can exploit this vulnerability, which has a CVSS score of 8.7 and is classified as HIGH.

Recommended defensive actions

• Inventory n8n installations and verify versions are within the affected ranges.
• Restrict global:member privileges to minimize exploitation risk.
• Implement compensating controls such as web application firewalls.
• Monitor for suspicious activity and exception tracking.
• Apply vendor remediation when available.

Evidence notes

The vulnerability exists in n8n before 2.33.4 and 2.34.x before 2.34.1 due to a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

Official resources