n8n: Microsoft SQL Node Prototype Pollution
n8n
- Severity
- High, CVSS 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
- Record
- CVE-2026-54312
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses n8n, a tool for automating tasks by connecting different apps and online services, at a version before 2.24.0. The problem is in the Microsoft SQL building block, the part of a workflow that connects to Microsoft SQL databases. Someone who can log in to n8n and has permission to create or change workflows could enter a specially crafted value there that corrupts how the whole n8n server checks its data. After that, n8n stops working completely until it is restarted. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should check which version is in use.
- If the version is older than 2.24.0, update n8n to version
2.24.0or later, which fixes this flaw. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- Until the update is done, know that if n8n suddenly stops working because of this flaw, restarting the n8n server brings it back into use.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.