CVE-2026-77080 is an OS command injection vulnerability in n8n's Snowflake node affecting versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. The flaw arises from improper neutralization of special elements in the Execute Query input, which is passed directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can exploit this to upload local files from the n8n host or overwrite existing files, leading to arbitrary file read and write capabilities on the host system. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7. Since n8n is offered as a cloud service, the vendor typically manages patching and remediation on their side.

An authenticated user with valid Snowflake credentials can exploit this vulnerability to read arbitrary files from the n8n host or write files by uploading or overwriting them. This could lead to unauthorized access to sensitive data or modification of files on the host system. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk. However, exploitation requires authentication and valid Snowflake credentials.

Since n8n is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their instance has been updated to versions 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later. If self-hosting, upgrade to these fixed versions immediately to mitigate the vulnerability. No additional mitigations are specified in the advisory.