CVE-2026-77072 n8n-io CVE debrief

Who should care

Users of n8n before versions 1.123.69, 2.33.4, and 2.34.1 should be aware of this vulnerability and take steps to mitigate it. This includes operators, administrators, and security teams responsible for n8n deployments. They should review and implement security measures to protect against this vulnerability, such as restricting access to Form node completion pages and educating users on secure practices when using n8n. Additionally, they should prioritize updating to a secure version of n8n and consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Platform and security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management is crucial to identify potentially affected systems. Rollback/change windows should be considered if immediate patching is not feasible. Source tracking and monitoring can help in identifying potential security breaches. Implementing additional security measures such as Web Application Firewalls can also be beneficial. Educating users on secure practices when using n8n is essential to prevent exploitation. Compensating controls should be reviewed and implemented if necessary. Exposure review is necessary to understand the potential impact of this vulnerability on the organization. Vendor patch guidance should be followed to ensure timely remediation. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Asset inventory and source tracking can help in prioritizing remediation efforts. Security teams should work closely with operators and administrators to ensure that all necessary security measures are implemented to protect against this vulnerability. Security teams should also review and implement secure coding practices to prevent similar vulnerabilities in the future. The completion page of the Form node in n8n before versions 1.123.69, 2.33.4, and 2.34.1 applied its sandboxing Content-Security-Pol

Technical summary

The completion page of the Form node in n8n before versions 1.123.69, 2.33.4, and 2.34.1 applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin.

Defensive priority

Authenticated users could exploit this vulnerability to execute scripts same-origin with their session.

Recommended defensive actions

• Inventory n8n installations and verify versions are up-to-date
• Restrict access to Form node completion pages
• Monitor for suspicious activity on n8n instances
• Implement additional security measures such as Web Application Firewalls
• Educate users on secure practices when using n8n

Evidence notes

The CVE-2026-77072 record indicates a stored cross-site scripting vulnerability in n8n before versions 1.123.69, 2.33.4, and 2.34.1. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Evidence is limited to CVE and NVD details. Defenders should verify n8n installations, review Form node completion pages, and monitor for suspicious activity.

Official resources