n8n: HTTP Request Node Pagination Prototype Pollution to RCE
n8n
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-44789
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for connecting apps and automating routine tasks. It affects versions before 1.123.43, 2.22.1 and 2.20.7. The problem is in the building block that lets a workflow send web requests to other services, specifically its option for fetching results page by page. A person who is signed in and allowed to create or change workflows could use it to tamper with how the whole program behaves. Combined with other techniques, this could let them run their own commands on the server running n8n. This flaw is rated Critical.
What to do
- Find out who looks after n8n for your organization: the person who installed or runs it, or the IT provider or vendor who manages it for you.
- If your organization runs n8n itself, that person should update it to
1.123.43,2.22.1or2.20.7, choosing the fixed release in the same series as the version you use now. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.