CVE-2026-77068: n8n Member RCE via MCP Node-Schema Path Traversal

TL;DR: n8n MCP node-schema loading in @n8n/workflow-sdk derived a schema module path from the attacker-supplied node type string and did not reject path-traversal sequences. An authenticated global:member can cause code execution in the n8n MAIN process. That is CWE-22. GitHub rates GHSA-6h4x-896x-fw5m High, CVSS 4.0 8.7 (PR:L). VulnCheck uses the same vector and credits Haruna38. n8n patched it in 2.33.4 and 2.34.1 on 2026-08-05. CVE-2026-77068 is the 2026-08-20 assignment, not a new patch. Current stable observed 2026-08-20 is 2.35.5. Not unauthenticated. Not in CISA KEV.

What happened

n8n (npm package n8n, vendor n8n-io) is a workflow automation and agent platform. Instance-level MCP loads node schemas through @n8n/workflow-sdk. The loader treated the node type string as a module path. It did not reject traversal sequences, so a caller who can name a node type can point the loader at a file outside the intended schema tree. Loading that file runs in the n8n MAIN process. global:member is a low-privilege role, not an admin gate. The CVSS vector is PR:L. This is not an unauthenticated bug.

GitHub published GHSA-6h4x-896x-fw5m on 2026-08-05, the same day as the patched releases. The GHSA page listed no CWE and no CVE at publish time. VulnCheck assigned CVE-2026-77068 on 2026-08-20 and classified it CWE-22. Self-hosted instances still on 2.33.3, 2.34.0, or older 2.x on those lines remain in scope.

Reporter credit in the VulnCheck advisory is Haruna38.

The same 2026-08-20 CVE drop also assigned two sibling n8n issues that share the 2.33.4 / 2.34.1 train: CVE-2026-77073 (cross-project credential access via MCP) and CVE-2026-77077 (EventEmitter prototype pollution in the Code node runner). This article covers CVE-2026-77068 only.

Affected versions

• Package: npm n8n (vendor n8n-io)
• Affected (HOL evidence pack): n8n-io/n8n >=0 <2.34.1 (fixed in 2.34.1) and >=0 <2.33.4 (fixed in 2.33.4)
• Fixed: 2.33.4, GitHub release 2026-08-05T08:32:58Z. 2.34.1, GitHub release 2026-08-05T08:28:33Z (marked prerelease).
• Current stable observed 2026-08-20: [email protected]
• 1.x: GHSA does not list a 1.x patched release for this CVE.
• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). VulnCheck lists CWE-22. The GHSA page listed no CWE at publish time.
• CVSS: GitHub GHSA-6h4x-896x-fw5m, High, CVSS 4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). VulnCheck uses the same 8.7 vector. HOL Guard's evidence pack still has cvssScore: null. Not listed in CISA KEV. knownExploited is false in the HOL pack.
• Preconditions: authenticated global:member. Instance-level MCP node-schema loading. Not unauthenticated.

How to fix

Upgrade to current stable:

npm install -g [email protected]

Confirm the installed version:

n8n --version

The version must be 2.35.5 or newer on the current line. If you pin a 2.33 train, the minimum is 2.33.4. If you pin a 2.34 train, the minimum is 2.34.1. Do not stay on 2.33.3, 2.34.0, or any earlier 2.x on those lines.

GitHub's workarounds are not a full fix. Until you upgrade: restrict the instance to fully trusted users; disable Instance-level MCP if you do not need it; run n8n as a dedicated low-privilege OS user so MAIN-process code execution is not the host's admin.

Technical details

MCP node-schema loading goes through @n8n/workflow-sdk. The loader built a schema module path from the node type string the caller supplied. It did not reject path-traversal sequences in that string, so the resolved module was not confined to the intended schema directory. That is CWE-22. Because the loaded module runs in the n8n MAIN process, a hostile file becomes code execution with MAIN privileges, not a sandboxed worker.

PR:L on the CVSS 4.0 vector is the global:member gate. A member is enough. An unauthenticated internet client is not.

The vendor advisory and the patched releases landed on 2026-08-05. CVE-2026-77068 is the later assignment. HOL Guard first saw the CVE record at 2026-08-20T11:40:19.672Z, after the CVE List publishedAt of 2026-08-20T11:21:04.945Z.

HOL Guard's evidence pack still has cvssScore: null and editorialStatus: not_started. The 8.7 High score above comes from GHSA-6h4x-896x-fw5m and the VulnCheck advisory, not from an NVD analysis score in the HOL pack.

This article is the operator write-up: what broke, who is affected, and how to fix it. The HOL Guard evidence page is the source record for CVE-2026-77068.

References

• HOL Guard CVE evidence page
• CVE-2026-77068 CVE List record
• GHSA-6h4x-896x-fw5m
• [email protected] release
• [email protected] release
• npm n8n
• VulnCheck advisory