Arbitrary File Access Vulnerability in n8n Snowflake Node
CVE-2026-77080

8.7HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
20 August 2026

What is CVE-2026-77080?

The n8n platform, prior to version 1.123.69 and certain 2.x versions, is susceptible to an arbitrary file read and write vulnerability within the Snowflake node. This flaw allows authenticated users with valid Snowflake credentials to execute unrestricted file read and write operations. Specifically, it enables attackers to upload local files from the n8n host or overwrite existing files, as user input directed to the Snowflake SDK is not properly sanitized against n8n's file-access constraints.

Affected Version(s)

n8n 0 < 1.123.69

n8n 2.34.0 < 2.34.1

n8n 2.0.0 < 2.33.4

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-r4...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-arbitrary...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

simonkoeck
.