A serious security flaw has been discovered in n8n, an open-source workflow automation tool. This vulnerability, identified as CVE-2026-72769, involves a ‘prototype pollution’ issue within its VM expression engine. It allows an authenticated attacker to potentially take over the system by escaping the secure environment (sandbox) and causing a denial of service. This could even lead to unauthorized code execution. Both self-hosted and cloud versions of n8n using this expression engine are at risk.
CVE Details
This vulnerability is officially tracked as CVE-2026-72769, and is also referenced by the GitHub Advisory GHSA-hx4h-vr3m-45vh.
- Product Name: n8n
- Published Date: August 11, 2026
- Severity: HIGH
- Status: Analyzed
Affected Products
The security flaw impacts various versions of n8n before specific patches were released. Specifically, users running the n8n workflow automation platform are vulnerable if their version is older than:
- n8n versions before 1.123.67
- n8n versions before 2.31.5
- n8n versions before 2.32.1
This includes both self-hosted and cloud instances of n8n that utilize the VM expression engine.
Current Status
The vulnerability has been thoroughly analyzed, and patches are available to address the issue. Users are strongly advised to update their n8n installations to a secure version as soon as possible to mitigate the risk.
Severity Level
The vulnerability is rated as HIGH severity. This high rating is due to the potential for an authenticated attacker to perform a ‘sandbox escape.’ This means they can break out of the confined environment designed to restrict their actions. By polluting the prototype in the main n8n process, an attacker can achieve denial of service and, more critically, could potentially execute arbitrary code on the affected system. This level of access can lead to significant data breaches, system compromise, or complete unavailability of services.
Possible Solutions
Immediate action is recommended to protect your n8n instances from this vulnerability.
Patches:
The n8n team has released patches addressing this issue. Users should upgrade their n8n installations to one of the following versions (or newer):
- n8n 1.123.67 or later
- n8n 2.31.5 or later
- n8n 2.32.1 or later
Upgrading to a patched version is the most effective way to resolve this vulnerability.
Workarounds (Temporary):
If an immediate upgrade is not feasible, consider these temporary mitigation steps. Please note, these do not fully eliminate the risk and should only be used as short-term measures:
- Restrict User Access: Limit access to your n8n instance strictly to fully trusted users only. This reduces the pool of potential attackers who could exploit the authenticated vulnerability.
- Disable VM Expression Engine: If your deployment allows and you have an alternative, consider disabling the VM expression engine.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-hx4h-vr3m-45vh
https://www.vulncheck.com/advisories/n8n-before-prototype-pollution-via-vm-expression-engine
