n8n CVE-2026-59206

Exploitation requires an authenticated n8n account holding the workflow:create permission - which is granted by DEFAULT, so any standard instance member qualifies - plus the ability to save, update, or import a crafted workflow via the workflow API. What limits it: the attacker must already have a valid low-privilege account (PR:L), so it is not exploitable by a fully anonymous outsider without first obtaining or being granted an account; single-user/self-hosted instances with no untrusted members face little practical exposure. The escalation payoff is that AFTER pollution, unauthenticated requests are treated as privileged, exposing user and project listing endpoints.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N with subsequent-system SC:L/SI:L) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality impact - consistent with the description's requirement for a valid account holding the default workflow:create permission. The PR:L is the key limiter: this is not an unauthenticated internet-wide bug, but the required permission is a DEFAULT one, so any ordinary member of an n8n instance qualifies, materially raising real-world risk in multi-user deployments. No EPSS score, KEV listing, or POC was provided, so exploitation appears theoretical for now; the subsequent-system impact (unauthenticated requests gaining privilege) is the notable escalation and warrants prompt patching despite the absence of active-exploitation signals. Note: the vulnerable actor is authenticated (PR:L) but the RESULTING exposed requests are unauthenticated - do not conflate the two.

An attacker with an ordinary n8n account (default workflow:create permission) crafts a workflow JSON containing a __proto__ payload and saves or imports it through the workflow API, polluting Object.prototype server-wide. They then issue unauthenticated requests that are now evaluated as a privileged user, enumerating internal user and project listing endpoints to harvest account and project metadata. No public exploit code was identified at time of analysis, but the low attack complexity makes weaponization straightforward once the sink is known.