CVE-2026-77080
Received Received - Intake

Arbitrary File Read and Write in n8n Snowflake Node

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77080
EUVD
EUVD-2026-63268

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 2.33.4 (exc)
n8n n8n to 2.34.1 (exc)
n8n n8n to 1.123.69 (exc)
n8n n8n From 2.0.0 (inc) to 2.33.4 (exc)
n8n n8n From 2.34.0 (inc) to 2.34.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77080 is an arbitrary file read and write vulnerability in the n8n workflow automation tool. It affects the Snowflake node, which allows free-form Execute Query input to be passed directly to the Snowflake SDK without enforcing n8n's file-access restrictions. This enables authenticated users with valid Snowflake credentials to upload files from the n8n host or overwrite existing files with staged ones.

The vulnerability impacts n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. It has a high severity score of 8.7 (CVSS v4) due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires checking the version of n8n installed on your system. If you are running a version prior to 1.123.69, 2.33.4, or 2.34.1, your system is vulnerable. Use commands like 'n8n --version' or check your package manager for installed versions.

Impact Analysis

An attacker with valid Snowflake credentials could exploit this to read sensitive files from the n8n host or overwrite critical system files. This could lead to data breaches, system compromise, or disruption of services. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected n8n versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade n8n to a patched version (1.123.69 or later, 2.33.4 or later, or 2.34.1 or later). If upgrading is not possible, disable the Snowflake node, restrict instance access, or run n8n under a low-privilege user account to limit potential damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart