The n8n workflow automation platform has a serious security flaw that could let unauthorized users take full control of systems. This vulnerability, identified as CVE-2026-44789, is rated as Critical and highlights the importance of keeping software updated.
An attacker could exploit this by making small changes to how n8n handles data, eventually running their own malicious code. This is known as “prototype pollution” and, in this case, it means a bad actor with certain permissions could trick the system into running commands it shouldn’t.
If you are using n8n, it is crucial to update your installation immediately to the patched versions to protect your systems.
CVE Details
- Product: n8n (specifically the Node.js package)
- CVE ID: CVE-2026-44789
- Published Date: June 23, 2026
- Severity: Critical
- Status: Analyzed
Affected Products
This vulnerability impacts versions of n8n prior to the following:
- n8n versions before 1.123.43
- n8n versions before 2.22.1
- n8n versions before 2.20.7
Specifically, the Node.js package of n8n is affected.
Current Status
This vulnerability has been analyzed, and official patches are readily available. The security advisory from n8n-io was published on May 13, 2026, indicating that the vendor has addressed the issue.
Severity Level
CVE-2026-44789 is classified as Critical, with a CVSS score of 9.9 out of 10. A critical rating means this flaw could allow an attacker, even with low user privileges, to gain complete control over your n8n instance and potentially other connected systems. This could lead to a full compromise of data confidentiality, integrity, and availability. It requires an authenticated user with permission to create or modify workflows, but no additional user interaction is needed once the malicious workflow is crafted.
Possible Solutions
The most effective way to address this vulnerability is to update your n8n installation.
Immediate Action: Upgrade n8n
Users are strongly advised to upgrade to one of the following patched versions or newer:
- n8n version 1.123.43 or later
- n8n version 2.22.1 or later
- n8n version 2.20.7 or later
Temporary Workarounds (if immediate upgrade is not possible):
While upgrading is the best solution, if you cannot update immediately, consider these temporary steps:
- Restrict workflow creation and editing permissions to only users you completely trust.
- Disable the HTTP Request node. You can do this by adding
n8n-nodes-base.httpRequestto theNODES_EXCLUDEenvironment variable in your n8n setup.
Please remember, these workarounds offer only partial protection and should only be used as a short-term measure until a full upgrade can be performed.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-c8xv-5998-g76h
