Vulnerability Details CVE-2026-77068
n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 39.8%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-77068
-
cpe:2.3:a:n8n:n8n:2.33.0
-
cpe:2.3:a:n8n:n8n:2.33.1
-
cpe:2.3:a:n8n:n8n:2.33.2
-
cpe:2.3:a:n8n:n8n:2.33.3
-
cpe:2.3:a:n8n:n8n:2.34.0