CVE-2026-77068: n8n: RCE via path traversal in MCP schema loader

HIGH

Published August 20, 2026

CISO Take

n8n's @n8n/workflow-sdk node-schema loader builds a file path directly from an attacker-supplied node type string, and an authenticated user holding only the low-privilege global:member role can inject path-traversal sequences to make the loader execute an arbitrary file inside n8n's main process. This matters because n8n is widely used as an AI agent orchestration platform with MCP tool integrations, and this bug turns a low-privilege collaborator account into full code execution with access to every credential and connected AI tool in the instance. There's no public exploit, no nuclei template, no CISA KEV listing, and no EPSS score yet, so this isn't being mass-exploited today, but the flaw class (CWE-22) is trivial to weaponize once a PoC path is published, and the package already carries a middling OpenSSF Scorecard (6.6/10) and 201 prior CVEs. Patch to n8n 2.33.4 or 2.34.1 now, and in the meantime audit and restrict who holds global:member access. Watch for anomalous ../-style node type strings in workflow creation logs as a detection signal.

Sources:NVDGitHub AdvisoryATLASOpenSSFvulncheck.com

What is the risk?

High-severity, low-complexity path traversal (CWE-22) leading to remote code execution, but gated behind requiring an authenticated global:member account rather than being unauthenticated/internet-facing — this caps immediate mass-exploitation risk to malicious/compromised insiders. No CVSS score, EPSS percentile, public exploit, or nuclei template exists yet, and the CVE is not in CISA KEV, so active exploitation is currently unconfirmed. However, path traversal bugs are historically fast to weaponize once the specific traversal payload becomes public, and n8n's package risk profile (69/100 risk score, 6.6/10 OpenSSF Scorecard, 201 other CVEs in package history, 16 downstream dependents) indicates a platform with a history of security issues that is nonetheless deeply embedded in AI agent automation stacks. Organizations running multi-tenant n8n instances with several global:member accounts should treat this as urgent-patch-now, not wait-and-see.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated n8n account with the global:member role.

AML.T0012

Crafted Input

Attacker configures an MCP node with a node type string containing path-traversal sequences pointing to a file they control.

AML.T0049

Code Execution

The workflow-sdk schema loader resolves the traversal path and loads/executes the malicious file inside n8n's main process.

AML.T0050

Impact

Attacker gains full control of the n8n main process, exposing stored credentials, AI agent tool connections, and other users' workflows.

AML.T0112.000

Initial Access

Attacker obtains or already holds an authenticated n8n account with the global:member role.

AML.T0012

Crafted Input

Attacker configures an MCP node with a node type string containing path-traversal sequences pointing to a file they control.

AML.T0049

Code Execution

The workflow-sdk schema loader resolves the traversal path and loads/executes the malicious file inside n8n's main process.

AML.T0050

Impact

Attacker gains full control of the n8n main process, exposing stored credentials, AI agent tool connections, and other users' workflows.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.9%

chance of exploitation in 30 days

Higher than 61% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade immediately to n8n 2.33.4+ (2.33.x line) or 2.34.1+ (2.34.x line). If patching must wait, audit and minimize which accounts hold the global:member role, since it is the sole prerequisite for exploitation. Temporarily disable or restrict MCP node usage until patched. Add detection for path-traversal indicators (../, URL-encoded traversal, absolute paths) in node type strings submitted through the workflow editor or REST API, and review audit logs for workflow changes made by non-admin members. Run the n8n container/host with least-privilege filesystem and network access to limit blast radius if exploited. Track CISA KEV and VulnCheck for a status change, since this is not yet flagged as actively exploited.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAgentPluginAML.T0010.005- AI Agent Tool AML.T0049- Exploit Public-Facing Application AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1-Third-party AI system risk response

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-77068?

Is CVE-2026-77068 actively exploited?

No confirmed active exploitation of CVE-2026-77068 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77068?

Upgrade immediately to n8n 2.33.4+ (2.33.x line) or 2.34.1+ (2.34.x line). If patching must wait, audit and minimize which accounts hold the global:member role, since it is the sole prerequisite for exploitation. Temporarily disable or restrict MCP node usage until patched. Add detection for path-traversal indicators (../, URL-encoded traversal, absolute paths) in node type strings submitted through the workflow editor or REST API, and review audit logs for workflow changes made by non-admin members. Run the n8n container/host with least-privilege filesystem and network access to limit blast radius if exploited. Track CISA KEV and VulnCheck for a status change, since this is not yet flagged as actively exploited.

What systems are affected by CVE-2026-77068?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, MCP tool integrations.

What is the CVSS score for CVE-2026-77068?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation pipelinesMCP tool integrations

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0049Exploit Public-Facing Application

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

Exploitation Scenario

An attacker holds or obtains a global:member account on a shared n8n instance — e.g., a contractor with routine workflow-editing access, or an attacker who phished a low-privilege collaborator. Through the workflow editor or API, they configure an MCP-integrated node and set its node type string to a path-traversal payload (e.g., ../../../../tmp/evil-module) instead of a legitimate type name. Because the workflow-sdk loader derives the schema module path directly from this string without validating traversal sequences, it loads and executes the attacker's file inside n8n's main process. The attacker now has code execution with the n8n service account's privileges, letting them exfiltrate stored credentials, hijack connected AI agent tool integrations, or tamper with workflows belonging to other users on the same instance.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.