CVE-2026-77068: n8n before 2.34.1 Remote Code Execution via Path Traversal
n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Exploitation requires authentication as an n8n user with global:member privileges. The vulnerable schema loader processes an attacker-controlled node type string during MCP node-schema loading.
Which versions need remediation?
n8n versions before 2.33.4 are affected, as are 2.34.x releases before 2.34.1. Upgrading to 2.33.4 or 2.34.1, as applicable, removes the affected version ranges.
What is the impact of successful exploitation?
A user can use path-traversal sequences in a node type string to reference malicious files. This can result in code execution in the n8n main process.