CVE-2026-77068

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1

Description A remote code execution issue exists in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader determines a node's schema module path using a node type string provided by the user without validating path-traversal sequences. An authenticated user with global:member privileges can use path traversal to reference malicious files, leading to code execution within the n8n main process.

Recommendations Update to version 2.33.4 or later. Update to version 2.34.1 or later.