CVE-2026-77074: n8n SSRF/LFI via MVG injection

CISO Take

n8n's Edit Image node lets authenticated users pass raw text into ImageMagick's Draw Text operation without sanitizing it against MVG (Magick Vector Graphics) primitives — the same injection class behind 2016's ImageTragick — so a logged-in user can smuggle directives that make the n8n server issue blind outbound HTTP requests to arbitrary hosts or read local files. Because n8n is widely used to orchestrate AI agent workflows and stores credentials for connected services (LLM API keys, cloud accounts, internal tools) in its workflow store, an SSRF or local file read here is a plausible path to credential theft or cloud metadata exposure (e.g., 169.254.169.254), not just a cosmetic bug. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this reads as a real but not currently weaponized risk — though n8n's own track record (201 prior CVEs, OpenSSF Scorecard 6.6/10) argues for treating any n8n advisory with urgency rather than deferring it. Patch to n8n 1.123.69 or later; until then, restrict who can create or edit workflows containing the Edit Image node and monitor outbound traffic from the n8n host for connections to internal or metadata IP ranges.

Sources:NVDGitHub AdvisoryVulnCheckOpenSSFATLAS

What is the risk?

Medium severity is reasonable given the authentication requirement — this isn't exploitable by an anonymous internet attacker, it requires an existing n8n account with workflow-editing rights. That said, n8n deployments commonly have multiple users with varying trust levels (contractors, automation developers, even semi-trusted internal teams), so 'authenticated' is a modest bar in practice. The impact tier is disproportionate to the CVSS gap in the data: successful exploitation yields SSRF (internal network/cloud metadata reach) or arbitrary local file read, both of which are high-value primitives for credential theft. No active exploitation, no KEV listing, and no public PoC lower urgency for immediate emergency patching, but this should not sit in a backlog given n8n's role as an AI workflow orchestrator with broad credential access.

How does the attack unfold?

Initial Access

Attacker uses valid, low-privileged n8n account credentials to access a workflow with editing rights.

AML.T0012

Malicious Input Crafting

Attacker edits an Edit Image node's Draw Text operation, embedding MVG primitives designed to trigger ImageMagick's URL or file-read directives.

AML.T0049

SSRF / Local File Read

Workflow execution causes the server's ImageMagick process to issue a blind outbound HTTP request to an arbitrary or internal host, or to read a local file.

Impact

Attacker captures the leaked response or file contents, potentially exposing credentials for connected AI/LLM services and enabling further lateral movement.

AML.T0083

Initial Access

Attacker uses valid, low-privileged n8n account credentials to access a workflow with editing rights.

AML.T0012

Malicious Input Crafting

Attacker edits an Edit Image node's Draw Text operation, embedding MVG primitives designed to trigger ImageMagick's URL or file-read directives.

AML.T0049

SSRF / Local File Read

Workflow execution causes the server's ImageMagick process to issue a blind outbound HTTP request to an arbitrary or internal host, or to read a local file.

Impact

Attacker captures the leaked response or file contents, potentially exposing credentials for connected AI/LLM services and enabling further lateral movement.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to n8n >=1.123.69 immediately (fix detailed in GHSA-233r-fpgw-fx8x). Until patched, restrict which users/roles can create or edit workflows containing the Edit Image node, and audit existing workflows for suspicious Draw Text values (embedded URLs, @/text:-style file references, or MVG control characters). Apply network egress controls on the n8n host to block outbound requests to cloud metadata IPs (169.254.169.254, metadata.google.internal) and other sensitive internal ranges. Monitor logs for anomalous outbound HTTP requests or file-read errors originating from image-processing workflow executions. If exploitation is suspected, rotate all credentials stored in the affected n8n instance's credential store.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageCode ExecutionAgentPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-Third-party and supplier relationships

NIST AI RMF

MANAGE-2.3-Mechanisms for third-party AI system risks

OWASP LLM Top 10

LLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77074?

n8n's Edit Image node lets authenticated users pass raw text into ImageMagick's Draw Text operation without sanitizing it against MVG (Magick Vector Graphics) primitives — the same injection class behind 2016's ImageTragick — so a logged-in user can smuggle directives that make the n8n server issue blind outbound HTTP requests to arbitrary hosts or read local files. Because n8n is widely used to orchestrate AI agent workflows and stores credentials for connected services (LLM API keys, cloud accounts, internal tools) in its workflow store, an SSRF or local file read here is a plausible path to credential theft or cloud metadata exposure (e.g., 169.254.169.254), not just a cosmetic bug. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this reads as a real but not currently weaponized risk — though n8n's own track record (201 prior CVEs, OpenSSF Scorecard 6.6/10) argues for treating any n8n advisory with urgency rather than deferring it. Patch to n8n 1.123.69 or later; until then, restrict who can create or edit workflows containing the Edit Image node and monitor outbound traffic from the n8n host for connections to internal or metadata IP ranges.

Is CVE-2026-77074 actively exploited?

No confirmed active exploitation of CVE-2026-77074 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77074?

Upgrade to n8n >=1.123.69 immediately (fix detailed in GHSA-233r-fpgw-fx8x). Until patched, restrict which users/roles can create or edit workflows containing the Edit Image node, and audit existing workflows for suspicious Draw Text values (embedded URLs, `@`/`text:`-style file references, or MVG control characters). Apply network egress controls on the n8n host to block outbound requests to cloud metadata IPs (169.254.169.254, metadata.google.internal) and other sensitive internal ranges. Monitor logs for anomalous outbound HTTP requests or file-read errors originating from image-processing workflow executions. If exploitation is suspected, rotate all credentials stored in the affected n8n instance's credential store.

What systems are affected by CVE-2026-77074?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / agent orchestration, self-hosted AI agent deployments.

What is the CVSS score for CVE-2026-77074?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation / agent orchestrationself-hosted AI agent deployments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.

Exploitation Scenario

A low-privileged n8n user — a contractor or automation developer with workflow-editing access but no infrastructure access — adds or edits an Edit Image node in a workflow and sets the Draw Text operation's text field to a crafted MVG payload referencing an internal URL (e.g., the cloud instance metadata endpoint) or a local file path. When the workflow executes, the underlying ImageMagick process processes the injected primitives, issuing a blind outbound HTTP request to the attacker-controlled or internal target, or reading local file contents that get embedded in or reflected through the generated image output. The attacker collects the response (via an out-of-band collaborator server for SSRF, or the rendered image for LFI), potentially harvesting cloud IAM credentials or n8n-stored API keys for connected AI services, which they then use for further lateral movement or data exfiltration.

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodePrimary CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.