EUVD-2026-101725
GHSA-fm6v-qhr5-4c32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as workflow:read member
-
ExploitSubmit crafted code to MCP validation interpreter
-
ExecutionPollute shared prototype to forge permission checks
-
ImpactTake over non-MFA owner account
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated n8n account holding at least a workflow:read grant, and the attacker must be able to reach and invoke the MCP workflow-validation tool whose interpreter evaluates caller-supplied code in the main process. The attack chains prototype pollution of a shared prototype into forged server-side permission checks; successful account takeover additionally requires that the targeted owner account is NOT protected by MFA. Limiting factors: valid low-privilege authentication is mandatory (not anonymous), the MCP validation feature must be enabled/reachable, and MFA on the owner account defeats the takeover step. Fixed in n8n 2.41.4 and 2.42.1. |
| Impact | This is a genuine privilege-escalation priority for exposed n8n instances, though not an internet-wide emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) describes a network-reachable flaw that is low-complexity but requires an authenticated low-privilege account (PR:L) and carries an attack requirement (AT:P), reflecting the dependence on reaching the MCP workflow-validation interpreter. Vulnerable-system impact is High across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) because the outcome is full owner-account takeover, while subsequent-system metrics are N, indicating the blast radius is the n8n application itself rather than cascading hosts. No EPSS score, CISA KEV listing, POC, or SSVC decision point was supplied in the input, so exploitation likelihood cannot be quantified from the data provided - the 7.7 score is the only hard risk signal. The practical risk hinges on two gates stated in the description: the attacker must already hold a workflow:read member credential, and the target owner account must lack MFA; both materially narrow real-world exploitability below what a raw network/low-complexity reading would suggest. |
| Exploit ScenarioDerived | An authenticated n8n user holding only a workflow:read grant invokes the MCP workflow-validation tool, which evaluates caller-supplied code in the main process. The attacker submits code that assigns onto a shared prototype to replace a built-in method with one returning a truthy value, causing server-side permission checks to accept scopes the account does not hold and permitting takeover of an owner account not protected by MFA. No public exploit identified at time of analysis, and no proof-of-concept was referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
RemediationAI
Vendor-released patch: upgrade to n8n 2.41.4 or, for the 2.42.x line, to 2.42.1 or later; these are the fixed versions named in the advisory and should be treated as the primary remediation, with the corresponding vendor guidance at https://github.com/n8n-io/n8n/security/advisories/GHSA-5jr4-xmvf-frmj. If immediate upgrade is not possible, the most effective compensating controls are to disable or remove network reachability for the MCP workflow-validation tool so its interpreter cannot accept caller-supplied code - the trade-off is loss of the MCP-based validation workflow for legitimate users - and to restrict who can hold even a workflow:read grant, since the vulnerability requires an authenticated account at that privilege level. Enforce MFA on every owner and administrator account, as the advisory chain explicitly notes that MFA defeats the account-takeover step even if the permission-check bypass is achieved; the trade-off is only operational friction for account holders, and this control does not prevent the underlying prototype pollution or information disclosure. Additionally, audit n8n account grants to remove unnecessary workflow:read assignments, monitor for unexpected changes to server-side permission behavior, and review logs for anomalous MCP validation invocations from low-privilege users. No vendor-published fixed version was identified beyond the two release lines above, and no public exploit code was identified at time of analysis, but the low authentication bar means exposure should be assessed against internet-reachable MCP endpoints first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a prototype pollution flaw (CWE-1321) rooted in the n8n MCP (Model Context Protocol) workflow-validation tool, whose interpreter evaluates caller-supplied code inside the Node.js main process rather than in an isolated sandbox. Because JavaScript object property lookups traverse the prototype chain, the interpreter both reads inherited properties and permits assignment onto shared prototypes such as Object.prototype. An attacker can therefore overwrite a built-in method with a function that returns a truthy value, so server-side authorization routines that consult that method conclude the caller holds scopes they were never granted. This turns a modest workflow:read grant into a permission-check bypass, which in turn enables takeover of owner accounts when those accounts are not protected by MFA. The reported CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) explicitly records the low privilege requirement (PR:L) and the presence of attack requirements (AT:P) reflecting the need to reach and invoke the MCP validation interpreter; the independent assessment records the equivalent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. network-reachable, high complexity, authenticated, with high confidentiality, integrity and availability impact confined to the vulnerable component.
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable but requires an authenticated low-priv member (PR:L) and depends on an MFA-absent target plus the interpreter path, so AC:H; account takeover yields full C/I/A.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.
Technical POC Analysis
Note on identifiers: the supplied advisory body (GHSA-5jr4-xmvf-frmj) lists "CVE ID: No known CVE" and "Weaknesses: No CWEs".
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
n8n's MCP workflow-validation feature contains a high-severity privilege-escalation flaw that can let a low-privilege user with only workflow:read access take over owner accounts lacking MFA, putting exposed automation environments at risk. Although no public exploit identified at time of analysis, successful exploitation could give an attacker control over critical workflows and connected systems, making this a priority for organizations running affected n8n versions. Leadership should care because owner-account takeover can bypass normal permission boundaries and lead to data loss, process disruption, or lateral movement into integrated services.
Disable MCP workflow-validation feature if not needed; restrict MCP endpoint to trusted networks; enforce MFA on all owner accounts; minimize workflow:read permissions; monitor for anomalous permission changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
Exploit-DB