n8n: N8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-77080
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- September 1, 2026
Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one.
Description quoted from the NVD record.
Who is affected
n8n is a tool that lets your organization connect apps and automate routine tasks as workflows. This flaw affects versions before 1.123.69, 2.x versions before 2.33.4, and 2.34.x versions before 2.34.1. The problem is in the building block that connects workflows to Snowflake, a cloud data service. That building block passes free-form queries along without n8n's usual limits on file access. A signed-in user with working Snowflake login details could send a file from the computer running n8n to Snowflake, or overwrite an existing file on that computer. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- Check which version of n8n you are running.
- Update n8n to version
1.123.69,2.33.4or2.34.1, whichever matches the release line you use, or to a later fixed release. - Give this update priority if any of your workflows connect to Snowflake, because the flaw is in that building block.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.