Executive brief
n8n is a workflow automation platform that integrates with various services like Snowflake. The Snowflake node in n8n passed user-supplied query commands directly to Snowflake's SDK without proper restrictions, allowing authenticated users with Snowflake credentials to read arbitrary files from the n8n server or overwrite existing files with malicious content. This could lead to data breaches or system compromise.
Technical details
The vulnerability exists in the Snowflake node where free-form Execute Query input, including client-side commands, is passed directly to the Snowflake SDK without applying n8n's file-access restrictions (CWE-78). An authenticated user with usable Snowflake credentials can exploit this to upload local files from the n8n host or overwrite existing files with staged content. The attack vector is network-based, requiring low privileges (user authentication) and no user interaction. The vulnerability has been patched in versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n before 1.123.69, 2.x before 2.33.4, 2.34.x before 2.34.1
Timeline
- 2026-08-05: disclosed: GitHub Security Advisory GHSA-r4j2-j3wm-q689 published
- 2026-08-05: patched: Fixes available in versions 1.123.69, 2.33.4, and 2.34.1