CVE-2026-86078 in n8n
Summary
by MITRE • 09/09/2026
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified involves a prototype pollution attack within the n8n workflow automation platform, specifically affecting instances running version prior to 2.37.7 or 2.38.2. This security flaw resides in the Instance AI feature responsible for generating summaries of workflows. The core technical issue stems from how the application handles data structures when processing workflow metadata submitted via the REST API. Specifically, the function summarizeWorkflowStructure located in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts fails to properly sanitize or validate object keys before using them as properties on a JavaScript Object instance. In standard JavaScript execution environments, objects inherit from a prototype chain that includes common methods and properties such as _proto_ and constructor. When an attacker submits a workflow definition containing these specific strings as node names or connection keys, the application inadvertently treats them as legitimate property assignments rather than literal string values intended for display purposes.
This improper validation allows nested writes to propagate up the object prototype chain until they reach Object.prototype. By modifying properties on this global base object, an attacker can effectively pollute all subsequent objects created within the same execution context of the main n8n process. This is a classic example of Prototype Pollution, which corresponds to CWE-1321 in the Common Weakness Enumeration taxonomy. The operational impact of such pollution is severe and multifaceted. It can lead to denial of service conditions by corrupting internal state variables or logic gates that rely on standard object properties. Furthermore, depending on how other parts of the application interact with these polluted objects, it may facilitate remote code execution if certain prototype methods are overwritten with malicious functions, although in this specific context, the primary risk highlighted is the disruption of subsequent requests and potential instability within the main process.
The attack vector requires interaction through the REST API, meaning that an authenticated user or any actor with access to submit workflow definitions can exploit this flaw. The persistence of the pollution means that a single malicious request can degrade the security posture for all future operations performed by the n8n instance until it is restarted or the polluted state is cleared. This highlights the critical importance of input validation in server-side JavaScript applications, particularly when dealing with dynamic object construction from user-supplied data. The vulnerability underscores the risks associated with using raw objects as dictionaries without explicit checks against prototype keys, a pattern that has historically led to numerous high-severity vulnerabilities across various web frameworks and libraries.
Mitigation for this issue is straightforward and involves upgrading the n8n installation to version 2.37.7 or later, where the summarizeWorkflowStructure function has been patched to properly handle these edge cases. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations should focus on restricting access to the REST API endpoints involved in workflow submission. Implementing strict input validation at a reverse proxy or load balancer level can help filter out requests containing _proto_ or constructor as keys before they reach the application logic. Additionally, developers reviewing similar code patterns within their own integrations with n8n should ensure that any custom scripts interacting with these APIs do not inadvertently expose other vectors for prototype pollution by failing to sanitize user input used in object property assignments.
From a threat intelligence perspective, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework under the category of Defense Evasion or Impact, specifically relating to resource hijacking through system process manipulation via software vulnerabilities like CVE-2024-XXXX (if assigned). The ability to disrupt service availability by polluting global state is a significant concern for platforms that rely on continuous processing and real-time workflow execution. Security teams should prioritize patching this vulnerability given its potential to cause widespread instability within the automation infrastructure. Regular security audits of JavaScript-based applications are recommended to identify similar patterns where user input is directly assigned as object keys without checking against reserved prototype properties, thereby preventing future instances of prototype pollution across the organization's technology stack.