CVE-2026-110842 in n8n
Summary
by MITRE • 10/15/2026
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in n8n versions prior to 2.41.4 and the 2.42.x series before version 2.42.1 represents a critical security flaw rooted in improper validation logic within the MCP workflow-validation tool. This component is responsible for interpreting and validating workflows, a process that inherently involves evaluating code provided by users or system integrations. The core technical failure lies in how this interpreter handles object properties during its evaluation phase. Specifically, it reads inherited properties from JavaScript prototypes without sufficient sanitization and permits direct assignment onto shared prototype objects. This behavior creates an avenue for Prototype Pollution, a well-documented class of vulnerabilities where attackers can inject malicious properties into the base Object.prototype or other built-in constructors, thereby affecting all objects that inherit from them within the application runtime environment.
From a technical perspective, this flaw allows an authenticated user to manipulate internal state in ways not intended by the developers. The vulnerability is particularly severe because it operates at the server-side level through the main process of the n8n instance. By exploiting the prototype pollution mechanism, an attacker can overwrite built-in methods or properties that are used for security checks and permission validation. In this specific context, the attacker targets a method involved in verifying user scopes and permissions. Through careful manipulation, the attacker replaces a standard verification function with a custom implementation that always returns a truthy value. This effectively bypasses the server-side logic designed to ensure that users only access resources they are explicitly authorized to view or modify.
The operational impact of this vulnerability is profound, as it directly undermines the authentication and authorization mechanisms protecting n8n instances. An attacker who holds even minimal privileges, specifically possessing only a workflow:read grant, can leverage this flaw to escalate their permissions significantly. By tricking the server into believing that certain security checks have passed when they have not, the attacker gains unauthorized access to scopes and capabilities far beyond their granted role. This capability enables the complete takeover of owner accounts within the n8n environment. The severity is further amplified by the fact that this attack can succeed against owners who are protected by Multi-Factor Authentication (MFA). Since the vulnerability exploits a logic flaw in permission validation rather than breaking cryptographic protections or stealing credentials, MFA offers no defense against it. Once an owner account is compromised, the attacker gains full control over all workflows, integrations, and data processed through that instance, potentially leading to widespread data exfiltration, manipulation of automated business processes, or use of the infrastructure for further malicious activities such as cryptocurrency mining or launching attacks on other systems.
This vulnerability aligns with CWE-1325: Incorrect Check of Unusual Condition in Security Feature, specifically regarding the failure to properly validate permissions after a bypass attempt, and CWE-691: Use of Less Strict String Comparison when considering prototype pollution techniques that rely on property existence checks rather than strict value validation. In terms of the MITRE ATT&CK framework, this exploit maps to T1078: Valid Accounts, as it relies on existing authentication but abuses privilege escalation mechanisms, and potentially T1546: Event Triggered Execution if the prototype pollution triggers specific automated workflows upon modification. It also reflects aspects of CWE-913: Improper Control of Dynamically-Managed Code Resources due to unsafe evaluation of user-supplied input in a server-side context.
To mitigate this risk, organizations running n8n must immediately upgrade to version 2.41.4 or later for the stable branch and version 2.42.1 or later for the 2.42.x series. These updates contain patches that enforce stricter validation on prototype assignments within the workflow-validation tool, ensuring that inherited properties are not blindly trusted and that built-in methods cannot be overwritten by user-supplied data. Until an upgrade is performed, administrators should consider restricting access to the MCP workflow-validation endpoints if possible, although this may impact legitimate functionality. Additionally, implementing strict Content Security Policies and monitoring for unusual patterns in API calls related to object property manipulation can help detect attempted exploitation. It is also advisable to review audit logs for any signs of unauthorized scope elevation or unexpected changes to user permissions following exposure to the vulnerable versions.