Understanding the n8n Prototype Pollution Vulnerability
A significant security flaw has been discovered in n8n, a popular open-source platform used for automating workflows. This vulnerability, identified as a “Prototype Pollution” issue, could allow attackers to manipulate how n8n processes data from public webhooks. This manipulation could lead to unauthorized actions within your workflows, posing a risk to data integrity and system security.
CVE Details
Product Name: n8n
Published: June 23, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to 2.25.7 and 2.26.2. If you are running any n8n instance older than these versions, your system is at risk.
Current Status
The vulnerability has been thoroughly analyzed, and its details are publicly available to ensure users are aware of the risks and can take appropriate action.
Severity Level
Rated as Medium severity, this vulnerability could allow an attacker to inject harmful data into your workflow processes. In simple terms, a specially crafted public webhook payload could trick your n8n workflows into executing unintended commands or accessing unauthorized data. This is often referred to as a “confused deputy” attack, where a legitimate system (the workflow) is coerced into performing malicious actions on behalf of an attacker, using the workflow owner’s genuine access credentials. The potential impact includes unauthorized modification of records or sending out requests that should not occur, compromising the confidentiality and integrity of your data.
Possible Solutions
The good news is that fixes are available. To fully protect your n8n installation, it is crucial to update to one of the patched versions:
- n8n version 2.25.7 or later
- n8n version 2.26.2 or later
These updates contain the necessary security patches to remediate the prototype pollution vulnerability. Updating your n8n instance should be your top priority.
If immediate upgrading is not possible, consider these temporary mitigation strategies:
- Avoid setting up public (unauthenticated) webhook workflows that take incoming data and pass it through transformation nodes into action nodes that handle sensitive credentials or perform database operations.
- Restrict the ability to create and edit workflows to only users you fully trust.
Please note that these workarounds do not completely eliminate the risk and should only be used as short-term measures until you can apply the official patches.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7
