n8n CVE-2026-72769

The attacker must be authenticated to the n8n instance and must hold permissions to create or edit workflow expressions - this is the primary gating condition captured by PR:L and AT:P in the CVSS 4.0 vector. The VM expression engine must be in active use; if an alternative expression evaluation mode is deployed, the vulnerable code path is not reached. Both self-hosted and cloud-hosted n8n instances are affected when these conditions are met. Exploitation is bounded to denial of service - the CVSS 4.0 vector explicitly records VC:N (no confidentiality breach), so data exfiltration is not a demonstrated impact of this specific vulnerability. The privilege requirement (workflow editing access) and the lack of a public exploit meaningfully reduce the realistic attack population, particularly in enterprise deployments with role-based access controls that limit who can author or modify workflows.

The CVSS 4.0 base score of 6.1 with vector AV:N/AC:L/AT:P/PR:L/UI:N reflects a network-reachable, low-complexity attack that requires authenticated low-privileged access and a specific attack precondition (AT:P) - the attacker must hold workflow creation or editing permissions. The VI:H and VA:H components confirm high integrity and availability impact to the vulnerable system (the main n8n process), while VC:N and SC/SI/SA:N indicate no confidentiality breach and no lateral scope change beyond the n8n host process. There is no EPSS score provided in the input data, and the CVE is not in CISA KEV, so real-world exploitation is unconfirmed. No public proof-of-concept code has been identified at time of analysis. The primary realistic risk is insider threat or a compromised low-privilege account in a shared n8n deployment being used to take down the service for all users. In tightly controlled deployments where workflow editing is restricted to a small set of fully trusted operators, real-world risk is substantially lower than the raw CVSS metrics suggest. The AT:P modifier in CVSS 4.0 appropriately captures this: widespread automated exploitation is unlikely given the authentication and permission prerequisites.

An authenticated n8n user with workflow editing rights creates a workflow containing a crafted expression that exploits the array-element access path in the VM expression engine to walk up to a host built-in object (such as Object or Array) living in the main n8n process. The attacker mutates that built-in's prototype with a poisoned property, which then propagates to every object in the process, causing unhandled errors or crashes that render the n8n instance unavailable to all users. No public proof-of-concept code has been identified, but prototype pollution sandbox-escape techniques against Node.js VM modules are well-documented in security research literature, reducing the required attacker skill level.