Remote Code Execution in n8n Workflow SDK by n8n.io

CVE-2026-77068

What is CVE-2026-77068?

The n8n workflow automation tool contains a vulnerability that allows authenticated users with global:member privileges to exploit the @n8n/workflow-sdk node-schema loader. By manipulating the node type string, an attacker can carry out path traversal attacks, leading to the execution of malicious code within the n8n main process. This vulnerability affects versions before 2.33.4 and 2.34.x prior to 2.34.1, highlighting the critical need for users to update to the latest secure version to mitigate the risk of exploitation.

References