CVE-2026-77079 n8n-io CVE debrief

Who should care

Organizations using n8n for workflow automation should be aware of this vulnerability and take steps to mitigate it. Users with the manageProject global scope are at risk of being exploited to gain unauthorized access to project administrative controls. IT administrators, security teams, and n8n instance operators should prioritize patching and review their configurations to prevent potential attacks.

Technical summary

The n8n workflow automation tool contains an authorization bypass vulnerability in its custom project role deletion (reassignment) path. A user with only the manageProject global scope can delete any custom project role and reassign its holders, including themselves, to the built-in project:admin role. This could allow an attacker to gain full administrative control of projects they should not have access to. The vulnerability stems from inadequate project-level authorization checks during role reassignment.

Defensive priority

Organizations using n8n should prioritize patching to prevent potential administrative control gains by attackers.

Recommended defensive actions

• Patch n8n to version 2.34.1 or 2.33.4 to fix the authorization bypass vulnerability
• Restrict the manageProject global scope to only necessary users
• Monitor project role changes and holder reassignments for suspicious activity
• Implement compensating controls to limit project administrative access
• Inventory and verify n8n instances for exposure
• Review project role configurations for potential exposure
• Conduct regular security audits to detect unauthorized role changes

Evidence notes

The CVE description indicates an authorization bypass in n8n's custom project role deletion path, allowing users with the manageProject global scope to delete and reassign custom project roles, potentially gaining full administrative control of projects they should not access. This issue arises from insufficient project-level authorization checks during role reassignment. To verify exposure, defenders should review project role configurations, monitor role changes, and assess user privileges.

Official resources