n8n Merge Node SQL Mode Prototype Pollution Vulnerability (CVE-2026-54311) — High Severity

Understanding the n8n Merge Node SQL Mode Prototype Pollution Vulnerability

A significant security flaw, identified as CVE-2026-54311, has been discovered in n8n, a popular open-source workflow automation platform. This vulnerability allows an authenticated user with limited privileges to potentially access sensitive workflow data belonging to other users on the same n8n instance. It’s a type of “Prototype Pollution” issue that specifically affects the Merge node when it’s used in SQL Query mode.

In simpler terms, if multiple users create and run workflows on an n8n instance, an attacker with basic access could tamper with the internal data environment used by the Merge node. Because n8n reuses this environment across different user workflows to save resources, the attacker’s changes could linger. This allows the attacker to intercept or view private information processed by other users’ workflows, leading to unauthorized data exposure.

This vulnerability is particularly relevant for multi-user n8n setups where different individuals have the ability to create and run their own workflows that use the Merge node’s SQL Query feature. Single-user instances or instances where only highly trusted users can create/modify such workflows are less affected.

CVE Details

• Product: n8n
• Published Date: June 23, 2026
• Severity: HIGH
• Status: Analyzed

Affected Products

This vulnerability impacts versions of n8n prior to 2.25.7 and 2.26.2. Specifically, any n8n instance running a version older than these releases is at risk if it’s a multi-user environment and allows users to create or modify workflows utilizing the Merge node in SQL Query mode.

Current Status

The vulnerability, CVE-2026-54311, has been thoroughly analyzed. Patches are available, and users are strongly advised to update their n8n installations to the fixed versions.

Severity Level

The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 7.7 (High Severity). This high rating indicates a considerable risk due to the potential for sensitive information disclosure to a low-privileged attacker over the network, with high attack complexity.

Possible Solutions

The most effective way to secure your n8n instance against CVE-2026-54311 is to upgrade to a patched version immediately. The issue has been fixed in the following releases:

• n8n version 2.25.7 and later
• n8n version 2.26.2 and later

If an immediate upgrade isn’t feasible, there are temporary workarounds to reduce the risk:

• Limit Permissions: Restrict workflow creation and editing permissions to only fully trusted users within your n8n instance. This minimizes the pool of potential attackers who could exploit this flaw.
• Disable Merge Node: You can disable the problematic Merge node entirely. To do this, add n8n-nodes-base.merge to the NODES_EXCLUDE environment variable in your n8n setup. Keep in mind that this will prevent all users from using the Merge node.

These workarounds are temporary and do not eliminate the risk entirely. Prioritize upgrading to the patched versions as soon as possible.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7