Understanding the n8n Prototype Pollution Vulnerability
n8n, a popular open-source platform for workflow automation, has identified a critical security flaw. This vulnerability, known as Prototype Pollution, could allow malicious actors to gain unauthorized access within the system. It affects specific versions of the platform, enabling an authenticated user with certain permissions to escalate their privileges and access sensitive information.
CVE Details
- Product: n8n
- Published Date: July 9, 2026
- Severity: High
- Status: Analyzed
Affected Products
The vulnerability impacts n8n versions prior to 1.123.61, 2.27.4, and 2.28.1. Specifically, any n8n instance running an older version is at risk.
Current Status
This vulnerability has been thoroughly analyzed, and the good news is that fixes are already available. The issue stemmed from an authenticated user, equipped with default workflow:create permissions, being able to manipulate the core system (Object.prototype) through specially designed workflows. This manipulation could trick the system into treating unauthenticated requests as though they came from a privileged user, exposing sensitive user and project data.
Severity Level
Rated as HIGH severity with a CVSS score of 7.1, this flaw poses a significant risk. The ability for an authenticated user to perform prototype pollution and then escalate privileges means that confidentiality and integrity of data could be compromised. This could lead to unauthorized access to user accounts and project listings, which is a serious concern for any organization relying on n8n for their automation.
Possible Solutions
The most important step to secure your n8n instance is to update to a patched version immediately. The development team has released updates that address this vulnerability. Users should upgrade their n8n installations to at least one of the following versions:
- 1.123.61
- 2.27.4
- 2.28.1
Regularly applying security updates is crucial for maintaining the integrity and security of your systems.
References
https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4
https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1
https://github.com/n8n-io/n8n/security/advisories/GHSA-75qm-gp28-rcq9
