PatchSiren cyber security CVE debrief
CVE-2026-77080 n8n-io CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.430Z and has not been modified since then. The n8n workflow automation tool contains an arbitrary file read and write vulnerability in the Snowflake node. The vulnerability occurs because the Snowflake node passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can exploit this vulnerability to upload a local file from the n8n host or overwrite an existing file with a staged one. This vulnerability affects n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. Users and administrators of n8n, especially those using the Snowflake node, should be aware of this vulnerability and take immediate action to protect their systems. Security teams and IT professionals responsible for monitoring and patching vulnerabilities in their organization's systems should prioritize this CVE. Immediate review of n8n configurations and Snowflake credential management is advised. Review and update n8n to version 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later. Restrict Snowflake credentials to minimal necessary permissions. Monitor n8n logs for suspicious Snowflake node activity. Implement additional access controls and file system restrictions for n8n. Verify and limit network exposure for n8n instances.
- Vendor
- n8n-io
- Product
- n8n
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-20
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-20
- Advisory updated
- 2026-08-21
Who should care
n8n users and administrators, especially those using the Snowflake node, should be aware of this vulnerability and take immediate action to protect their systems. Additionally, security teams and IT professionals responsible for monitoring and patching vulnerabilities in their organization's systems should prioritize this CVE.
Technical summary
The n8n workflow automation tool contains an arbitrary file read and write vulnerability in the Snowflake node. The vulnerability occurs because the Snowflake node passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can exploit this vulnerability to upload a local file from the n8n host or overwrite an existing file with a staged one.
Defensive priority
Authenticated users with Snowflake credentials could read and write arbitrary files via the Snowflake node in n8n. Immediate review of n8n configurations and Snowflake credential management is advised.
Recommended defensive actions
- Review and update n8n to version 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later
- Restrict Snowflake credentials to minimal necessary permissions
- Monitor n8n logs for suspicious Snowflake node activity
- Implement additional access controls and file system restrictions for n8n
- Verify and limit network exposure for n8n instances
Evidence notes
The CVE description indicates that n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 are vulnerable to arbitrary file read and write via the Snowflake node. The vulnerability allows an authenticated user with usable Snowflake credentials to upload a local file from the n8n host or overwrite an existing file with a staged one.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.430Z and has not been modified since then.