n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42232
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 4, 2026
- Source last modified
- June 17, 2026
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting different apps and services into step-by-step workflows. This flaw affects versions before 1.123.32, 2.17.4 and 2.18.1. A signed-in user who is allowed to create or change workflows could misuse the building block that reads XML data (a common data format) to tamper with how the whole program behaves. Combined with other building blocks, this could let that person run their own commands on the computer running n8n. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it for you. That person or company should handle the steps below.
- If you run n8n yourself, update it to version
1.123.32,2.17.4or2.18.1, whichever matches the version line you use now, or to a later release. These versions fix this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- If you are not sure which version you have, ask the person or provider from step 1 to check it.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.