CVE-2026-110848 in n8n
Summary
by MITRE • 10/15/2026
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in n8n versions prior to 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 represents a critical prototype pollution flaw within the AI workflow builder component. This security issue stems from an improper validation mechanism when merging workflow connections. Specifically, the system utilizes node names as object members during this merge operation without performing adequate checks for reserved JavaScript keys such as _proto_, constructor, or prototype. In standard web application development, allowing user-supplied input to directly set properties on objects that are later merged into a global context can lead to unintended side effects if those inputs match property names defined in the Object.prototype chain.
Authenticated users possess the ability to exploit this flaw by creating workflow nodes with specific maliciously crafted names via the API. By naming these nodes _proto_, an attacker can trigger the connect-nodes operation, which subsequently merges this node name into the application's internal object structures. Because JavaScript objects inherit properties from their prototype chain, setting a property named _proto_ effectively modifies the global Object.prototype rather than just creating a new key on the specific workflow object. This action pollutes the prototype of all subsequent objects created within that runtime environment, leading to widespread data corruption and unexpected behavior across the application instance.
The operational impact of this vulnerability is significant, primarily manifesting as a denial-of-service condition for the affected n8n instance. Once the global Object.prototype is polluted with malicious properties or values injected by an attacker, normal workflow execution logic fails because core JavaScript methods are overridden or corrupted. The system becomes unstable and unresponsive to legitimate operations until the application process is restarted. This effectively disrupts business continuity for organizations relying on n8n for automation workflows, as manual intervention in the form of a service restart is required to clear the polluted prototype state and restore normal functionality.
From a classification perspective, this vulnerability aligns with CWE-1325: Incorrectly Controlled Modification of Object Prototype Attributes, which covers scenarios where an attacker can modify properties on object prototypes through user-controlled input. It also maps to MITRE ATT&CK technique T1059.007: JavaScript, as the exploitation relies on manipulating JavaScript runtime behavior and prototype chains. The attack vector is classified under CWE-284: Improper Access Control because it requires authentication, yet the authenticated session lacks sufficient privilege separation or input validation for critical system operations like workflow node creation.
To mitigate this risk, organizations running affected versions of n8n must upgrade to version 1.123.83, 2.41.4, or 2.42.1 and later immediately. These releases include patches that enforce strict validation on object keys during the workflow merging process, ensuring that reserved prototype properties cannot be overwritten by user input. In environments where immediate patching is not feasible, administrators should restrict API access to trusted internal networks only and implement web application firewalls capable of detecting attempts to inject _proto_ or similar malicious property names into JSON payloads. Regular security audits focusing on object manipulation patterns in workflow builders are also recommended to prevent similar prototype pollution issues in future updates.