What happened
Published 2026-08-20, this cluster of n8n vulnerabilities affects the platform's MCP integration and AI-agent tooling: a path-traversal RCE in MCP node-schema loading, an SSRF-protection bypass in an AI search-agent tool, and a credential-validation bypass in an MCP workflow-creation tool.
Why it matters
n8n's MCP and AI-agent nodes are a growing agent-to-tool bridge in production automation pipelines; a low-privileged authenticated member achieving RCE via crafted MCP node-type strings, combined with an SSRF bypass specific to the AI agent tooling, shows that AI-specific extensions to established automation platforms are introducing new privilege-escalation and network-boundary-bypass paths.
Attack vector
CVE-2026-77068 (CVSS 8.8/8.7): the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading derives a schema module path directly from an attacker-supplied node-type string without path-traversal validation; an authenticated user with global:member privileges can reference malicious files and achieve code execution in the n8n main process. CVE-2026-77085 (CVSS 6.3): the SearXNG Agent tool bypasses n8n's centralized SSRF protection by using a raw HTTP client for user-supplied API URLs even when N8N_SSRF_PROTECTION_ENABLED=true. CVE-2026-77073 (CVSS 5.3): credential-validation bypass in the MCP create_workflow_from_code tool lets an attacker with a valid MCP Bearer API key persist unauthorized cross-project credential references.
Affected systems
n8n before 2.33.4 and 2.34.x before 2.34.1 (cluster: CVE-2026-77068, CVE-2026-77085, CVE-2026-77073)
Mitigation
Upgrade to n8n ≥2.34.1 (or ≥1.123.69/2.33.4 depending on branch) per GHSA-6h4x-896x-fw5m, GHSA-9rp2-wm75-c5fj, and GHSA-vfrj-582q-mvcp.