n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM…
n8n
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Record
- CVE-2026-72769
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for connecting apps and automating routine tasks, in versions before 1.123.67, 2.31.5 and 2.32.1. The problem is in the expression engine, the part that works out the small formulas people write inside workflows. Someone who has a login and is allowed to create or edit a workflow expression can break out of the engine's safety limits and disrupt the main n8n program, causing a denial of service (the service stops working properly). Both self-hosted and cloud setups that use this expression engine are affected. This flaw is rated High.
What to do
- If your organization runs n8n on its own server, the person who installed or looks after it should update it to the fixed version for the release line you use:
1.123.67,2.31.5or2.32.1. - If an IT provider or vendor runs n8n for your organization, including on n8n's cloud service, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses n8n, ask the person who sets up your automated tasks, or your IT provider, and share this advisory with them.
- After the update, have that person check that n8n shows one of the fixed version numbers listed above.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.