CVE-2026-77080: n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.69 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.33.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.34.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n user needs usable Snowflake credentials and access to the Snowflake node's free-form Execute Query input. The issue is therefore relevant where such users can configure or run Snowflake queries.
What access can an attacker gain on the n8n host?
The attacker can use Snowflake client-side commands passed through the Execute Query input to upload a local file from the n8n host or overwrite an existing host file with a staged file.
Which releases need to be updated?
Affected releases are n8n versions before 1.123.69, 2.x versions before 2.33.4, and 2.34.x versions before 2.34.1. Update to 1.123.69, 2.33.4, or 2.34.1 or a later applicable release.