Alex Joseph
A significant security flaw has been identified in n8n, a popular workflow automation tool. This vulnerability, tracked as CVE-2026-72749, could allow an authenticated attacker to trigger an instance-wide denial of service, making the system unavailable to all users.
CVE Details
This vulnerability is officially identified as CVE-2026-72749 and was published on August 11, 2026. The associated GitHub Security Advisory is GHSA-xwx6-jjhv-84p8, which was published on July 22, 2026.
- Product: n8n (Node.js versions)
- Published: August 11, 2026
- Severity: High
- Status: Analyzed
Affected Products
The prototype pollution vulnerability affects n8n installations running on Node.js. Specifically, the following versions are vulnerable:
- All n8n versions prior to 1.123.73
- All n8n versions prior to 2.35.4
- All n8n versions prior to 2.36.2
Current Status
The vulnerability has been thoroughly analyzed by security researchers. Patches are available from the vendor, and users are strongly advised to update their n8n instances to a secure version as soon as possible to mitigate the risk.
Severity Level
Rated as High severity with a CVSS v4 base score of 7.1, this vulnerability poses a significant risk to the availability of affected n8n instances. The core issue lies within the “Edit Fields (Set)” node. An authenticated attacker can exploit a flaw in how this node assigns output fields. By creating a specially crafted field name using dot-notation, the attacker can corrupt a critical shared global variable within the main Node.js process. When this global variable is compromised, n8n’s request authentication path fails for all subsequent authenticated requests. This effectively brings the entire n8n instance to a halt, causing an immediate denial of service for all users until the n8n process is manually restarted. While it requires an authenticated user to initiate the attack, the wide-ranging impact on system availability makes this a high-severity concern.
Possible Solutions
To secure your n8n instance against this prototype pollution vulnerability, follow these recommendations:
Patches:
The most effective solution is to upgrade your n8n installation to one of the following patched versions or later:
- n8n 1.123.73 or later
- n8n 2.35.4 or later
- n8n 2.36.2 or later
These versions contain the necessary fixes to address the vulnerability, providing robust protection against this specific attack vector.
Workarounds (Temporary Mitigation):
If an immediate upgrade is not feasible, consider implementing these temporary mitigation steps. Please note, these do not fully eliminate the risk and should only be used as short-term measures until you can apply the official patches:
- Restrict User Access: Limit n8n instance access strictly to fully trusted users only. This reduces the pool of potential authenticated attackers.
- Control Workflow Permissions: Disable or significantly restrict permissions for untrusted users to create and execute workflows. Since the vulnerability is tied to the “Edit Fields (Set)” node within workflows, limiting who can create or modify them can reduce exposure.
- Monitor and Restart: Actively monitor your n8n instance for unexpected HTTP 500 errors. If these process-wide errors occur, promptly restart the n8n process to restore service.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8
https://www.vulncheck.com/advisories/n8n-before-prototype-pollution-via-edit-fields
