Understanding the n8n Prototype Pollution Vulnerability
n8n, an open-source platform for workflow automation, recently addressed a security vulnerability identified as CVE-2026-86078. This issue, categorized as a medium-severity threat, could have allowed attackers to disrupt the normal operation of the platform.
At its core, this vulnerability is a type of “prototype pollution.” In simpler terms, this means that specific, crafted input could trick n8n into modifying fundamental settings or behaviors of its internal components. Imagine if someone could submit a document to a library that subtly changes the rules for how all future documents are handled—that’s the essence of prototype pollution. In n8n’s case, this flaw existed within the Instance AI workflow summary feature.
The vulnerability specifically allowed node names or connection keys within a workflow submitted via the REST API to contain special keywords like __proto__ or constructor. When processed, these keywords could lead to unexpected changes in JavaScript’s global Object.prototype. This kind of manipulation can lead to various issues, including denial of service or unexpected application behavior, by altering how n8n processes subsequent requests and operations.
CVE Details
- Product: n8n
- Published: September 8, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts versions of n8n prior to 2.37.7 and 2.38.2. If you are running an earlier version of the n8n workflow automation platform, your instance may be at risk.
Current Status
This vulnerability has been thoroughly analyzed, and the n8n development team has released patches to address the issue. The fix ensures that input containing potentially malicious keywords like __proto__ or constructor is handled safely, preventing any unauthorized modification of core object properties within the n8n process.
Severity Level
CVE-2026-86078 has been assigned a Medium severity rating with a CVSS score of 6.5. A medium severity rating indicates that while the vulnerability could lead to significant disruption or impact the integrity and availability of the system, it might not always allow for immediate, direct remote code execution or complete data compromise. For n8n, the primary concern is the potential to disrupt system operations and affect the reliability of automated workflows.
Possible Solutions
If you are using n8n, the most crucial step is to update your installation to a patched version immediately. The n8n team has provided fixes in the following releases:
- n8n version 2.37.7
- n8n version 2.38.2
Users are strongly advised to upgrade to version 2.37.7 or 2.38.2, or any newer available versions, to protect their workflow automation platforms from this prototype pollution vulnerability. Regularly updating your software is a fundamental cybersecurity best practice to ensure you have the latest security enhancements and bug fixes.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c
