CVE-2026-77068 n8n before 2.34.1 Remote Code Execution via Path Traversal
Authenticated users can achieve remote code execution in n8n by exploiting path traversal in the node-schema loader.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77068?
CVE-2026-77068 is a high-severity path traversal vulnerability in N8n N8n, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.
Weakness: CWE-22
Which versions are affected by CVE-2026-77068?
It affects 1 product.
Products include N8n N8n.
How do I fix CVE-2026-77068?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-77068 being exploited?
There is no known exploitation of CVE-2026-77068 in the wild and no public exploit code.
Other vulnerabilities in N8n N8n
- CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources
- CVE-2026-21877 n8n is vulnerable to Remote Code Execution via Arbitrary File Write
- CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
- CVE-2026-1470 n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
- CVE-2025-68668 n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
Sources
Also known as GHSA-6h4x-896x-fw5m, GHSA-h5rm-9fhh-5phj, MINI-r4wm-f82h-mvgh.