CVE-2026-77070 n8n-io CVE debrief

Who should care

Organizations using n8n, especially those with MongoDB node operations, should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. The vulnerability's impact on the organization depends on the specific use of n8n and MongoDB node operations within their environment. Therefore, a thorough review of the current configurations and potential exposure is necessary to determine the appropriate course of action. This should involve coordination with relevant teams, including IT, development, and security, to ensure a comprehensive approach to addressing the vulnerability. Furthermore, organizations should consider implementing additional security measures, such as enhanced monitoring and incident response plans, to mitigate potential risks associated with this vulnerability. By taking these steps, organizations can help protect their systems and data from potential exploitation of this vulnerability. It is also recommended that organizations review their current vulnerability management processes to ensure they are equipped to handle similar vulnerabilities in the future. This may involve updating their vulnerability management policies, procedures, and training programs to address the evolving threat landscape. Overall, a proactive and multi-faceted approach is necessary to effectively manage and mitigate the risks associated with CVE-2026-77070. This includes not only patching and mitigation but also ongoing monitoring, review, and improvement of their security posture. By prioritizing the security of their systems and data, organizations can reduce the risk of exploitation and protect their core

Technical summary

The CVE-2026-77070 vulnerability is a NoSQL injection issue in n8n's MongoDB node operations, specifically in the Find, Delete, and Aggregate operations. The vulnerability occurs because the Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators. This allows an attacker to inject operators such as $ne or $where, potentially leading to full-collection disclosure or deletion.

Defensive priority

Organizations using n8n should prioritize patching to prevent potential NoSQL injection attacks.

Recommended defensive actions

• Apply patches for n8n versions before 1.123.69, 2.33.4, and 2.34.1
• Restrict access to the MongoDB node
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates a NoSQL injection vulnerability in n8n's MongoDB node operations. The vulnerability allows an attacker to inject MongoDB operators, potentially leading to full-collection disclosure or deletion. The vendor has released patches for versions before 1.123.69, 2.33.4, and 2.34.1.

Official resources