n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project…
n8n
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
- Record
- CVE-2026-59206
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 9, 2026
- Source last modified
- October 25, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, an open source tool for automating tasks by connecting apps and services. It affects versions before 1.123.61, 2.27.4 and 2.28.1. A person who can sign in to n8n and has the standard permission to create workflows (which users have by default) could save, update or import a specially made workflow. This would cause n8n to treat requests from people who are not signed in as coming from a privileged user. That would expose lists of the users and projects in your n8n system. This flaw is rated High.
What to do
- If you or someone in your organization installed and runs n8n, that person should check which version is in use and update n8n to one of the fixed versions:
1.123.61,2.27.4or2.28.1. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses n8n, ask the person or company that looks after your computers and online services, and share this advisory with them.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.