n8n CVE-2026-77068

Exploitation requires an active authenticated session with global:member privileges on the target n8n instance - the lowest non-anonymous membership role. The attacker must be able to submit or modify workflows that invoke the MCP node-schema loader with a controlled node type string. The traversal payload must resolve to a file readable by the n8n server process that can be interpreted as a valid Node.js module; an attacker without a secondary file-write capability is limited to targeting files already present on the server (e.g., existing JavaScript files in node_modules or writable directories). The vulnerability is not exploitable without authentication. Deployments that restrict global:member access to vetted internal users, or that operate n8n in a heavily sandboxed container with minimal filesystem exposure, face meaningfully reduced risk. Cloud-managed n8n instances with vendor-controlled infrastructure may have additional isolation that limits exploitability, though this is not confirmed by available data.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately characterizes the threat: network-reachable, low complexity, requiring only a standard authenticated membership role, with full confidentiality, integrity, and availability impact on the n8n process. The low attack complexity is particularly significant - path traversal payloads are well understood and require minimal technical sophistication to construct once the advisory is public. The principal risk-limiting factor is the global:member authentication prerequisite, which narrows the attacker pool to credentialed platform users; organizations with strict n8n user provisioning are meaningfully less exposed than those with open registration or broad team membership. EPSS data was not provided in the input, so a numerical exploitation probability cannot be stated. The vulnerability is not currently listed in the CISA KEV catalog, and no public proof-of-concept code has been identified in the available intelligence. However, the simplicity of the vulnerability class and the availability of the vendor security advisory means exploit development is accessible, and even a small organization running a self-hosted n8n instance should treat this as urgent given the RCE-on-authenticated-user profile.

An attacker who holds a global:member account on a self-hosted n8n instance constructs a workflow node with a crafted node type string (e.g., '../../../../tmp/payload') referencing a JavaScript file previously written to the server via another vector, such as a file upload feature or pre-existing filesystem write access. When n8n's MCP node-schema loader processes the workflow, it resolves the traversal path outside the schema base directory and loads the attacker's file as a Node.js module, executing arbitrary code with the privileges of the n8n server process. No public proof-of-concept has been identified, but path traversal exploitation in Node.js dynamic module loading is a well-documented technique requiring minimal expertise.