CVE-2026-77080: n8n: Snowflake node allows arbitrary file read/write

HIGH

Published August 20, 2026

CISO Take

n8n's Snowflake node forwards free-form Execute Query input straight to the Snowflake SDK, including client-side staging commands, without applying n8n's normal file-access guardrails — so any authenticated user who holds working Snowflake credentials can pull an arbitrary file off the n8n host or overwrite one with a staged file. There's no public exploit or scanner template yet and it isn't in CISA KEV, but n8n sits in the ai_agent category with 16 tracked downstream dependents, a mediocre OpenSSF score of 6.6/10, and a package risk score of 69/100 backed by 201 other CVEs in the same codebase — a track record that argues for treating this as high-priority even absent active exploitation. The realistic risk is credential theft (reading .env files, SSH keys, service tokens on the host) or a write primitive used to overwrite a startup script, cron entry, or config file to escalate toward full host compromise. Patch to n8n 1.123.69, 2.33.4, or 2.34.1 immediately; in the interim, restrict which users hold usable Snowflake credentials inside n8n, scope those Snowflake roles to least privilege, and audit workflow execution logs for anomalous Snowflake PUT/GET/staging commands.

Sources:NVDGitHub Advisoryvulncheck.comATLASOpenSSF

What is the risk?

Rated high severity by the vendor. The requirement for an authenticated n8n user with valid, usable Snowflake credentials meaningfully narrows the exploitable population versus an unauthenticated bug, but n8n is frequently deployed with broad internal user access and shared service credentials for automation convenience, which erodes that barrier in practice. No CVSS vector, EPSS score, KEV listing, public exploit, or Nuclei template is currently available, so near-term mass exploitation is unlikely — but the underlying flaw (bypassing n8n's own file-access restrictions via free-form SDK passthrough) is a design-level trust boundary failure, not a one-off bug, and n8n's history of 201 other CVEs plus a below-average OpenSSF Scorecard (6.6/10) signal weaker-than-average security hygiene for a package this widely embedded in AI agent/automation pipelines.

How does the attack unfold?

Initial Access

Attacker obtains an authenticated n8n account that has been configured with usable Snowflake credentials, whether via insider access, phished credentials, or a shared automation account.

AML.T0012

Tool Abuse

Attacker crafts a workflow using the Snowflake node's free-form Execute Query field to submit a client-side staging command that the Snowflake SDK executes without n8n's file-access checks.

AML.T0053

File Read/Write

The Snowflake SDK reads an arbitrary file from the n8n host or overwrites an existing file with attacker-staged content.

AML.T0037

Impact

Attacker exfiltrates harvested secrets from the host or leverages the overwritten file to gain code execution and persistence on the n8n automation host.

AML.T0112.000

Initial Access

Attacker obtains an authenticated n8n account that has been configured with usable Snowflake credentials, whether via insider access, phished credentials, or a shared automation account.

AML.T0012

Tool Abuse

Attacker crafts a workflow using the Snowflake node's free-form Execute Query field to submit a client-side staging command that the Snowflake SDK executes without n8n's file-access checks.

AML.T0053

File Read/Write

The Snowflake SDK reads an arbitrary file from the n8n host or overwrites an existing file with attacker-staged content.

AML.T0037

Impact

Attacker exfiltrates harvested secrets from the host or leverages the overwritten file to gain code execution and persistence on the n8n automation host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade immediately to n8n 1.123.69 (1.x line), 2.33.4 (2.x line), or 2.34.1 — whichever track is deployed. 2) Until patched, disable or restrict the Snowflake node to trusted admin-only workflows and revoke Snowflake credential access from lower-trust users. 3) Apply least-privilege Snowflake roles (avoid STAGE/PUT/GET-capable roles for automation accounts where not strictly needed). 4) Review n8n execution logs and Snowflake query history for unexpected PUT/GET/COPY INTO or staging-related commands outside normal ETL patterns. 5) Restrict filesystem permissions on the n8n host so the n8n process user cannot read sensitive files (secrets, other services' configs) even if the restriction bypass is triggered. 6) Rotate any credentials that may have been staged on the n8n host as a precaution during the patch window.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageAgentPluginAML.T0037- Data from Local System AML.T0053- AI Agent Tool Invocation AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1-Operational planning and control

OWASP LLM Top 10

LLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77080?

Is CVE-2026-77080 actively exploited?

No confirmed active exploitation of CVE-2026-77080 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77080?

1) Upgrade immediately to n8n 1.123.69 (1.x line), 2.33.4 (2.x line), or 2.34.1 — whichever track is deployed. 2) Until patched, disable or restrict the Snowflake node to trusted admin-only workflows and revoke Snowflake credential access from lower-trust users. 3) Apply least-privilege Snowflake roles (avoid STAGE/PUT/GET-capable roles for automation accounts where not strictly needed). 4) Review n8n execution logs and Snowflake query history for unexpected PUT/GET/COPY INTO or staging-related commands outside normal ETL patterns. 5) Restrict filesystem permissions on the n8n host so the n8n process user cannot read sensitive files (secrets, other services' configs) even if the restriction bypass is triggered. 6) Rotate any credentials that may have been staged on the n8n host as a precaution during the patch window.

What systems are affected by CVE-2026-77080?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, data pipelines.

What is the CVSS score for CVE-2026-77080?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksdata pipelines

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0053AI Agent Tool Invocation

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one.

Exploitation Scenario

A contractor or lower-trust employee with legitimate n8n access and valid (but not host-admin) Snowflake credentials builds or modifies a workflow using the Snowflake node's Execute Query field. Instead of a normal SQL query, they submit a Snowflake staging command (e.g., a GET/PUT-style client-side file operation) that the Snowflake SDK executes directly, bypassing n8n's intended file-access sandboxing. Using this, the attacker either reads the n8n host's .env file to harvest API keys for connected AI services (LLM providers, vector DBs, other SaaS integrations) or overwrites a script/config file referenced by a scheduled n8n task, achieving code execution and persistence on the automation host on their next scheduled run.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-78Improper Neutralization of Special Elements used in an OS Command

CWE-78 — Improper Neutralization of Special Elements used in an OS Command: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.