EUVD-2026-101731
GHSA-v3wp-jvw4-xcp3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to n8n API
-
DeliveryCreate node named __proto__
-
ExploitInvoke connect-nodes merge operation
-
ExecutionPollute global Object prototype
-
ImpactDisrupt instance until restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on the n8n instance with the ability to create workflow nodes via the API (PR:L) and access to the AI workflow builder's connect-nodes operation. The attacker must specifically create a node named with the reserved key '__proto__' (or similar) and trigger the connection-merge, which fails to sanitize reserved keys - this specific crafted-input requirement corresponds to the AT:P attack requirement. Limiting factors: valid authentication is mandatory (no unauthenticated path), impact is confined to availability (the instance must be restarted to recover) with no data compromise, and only versions before 1.123.83, 2.41.4, or 2.42.1 are affected. |
| Impact | This is a moderate-severity denial-of-service issue, not a critical breach risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H) tells a consistent story: network-reachable but requiring authentication (PR:L) and a specific attack precondition (AT:P), with impact limited purely to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss. This directly contradicts the 'Information Disclosure' tag in the input, since the vector explicitly rates confidentiality impact as None; the real impact is service disruption until restart. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The score of 6.0 is appropriate: the authentication requirement and availability-only impact keep real-world risk below a top priority. The main caveat is that exploitation is trivial for any user who already holds valid, authenticated access with workflow-creation rights, so multi-tenant or shared n8n instances with low-trust users face higher practical exposure than single-operator deployments. |
| Exploit ScenarioDerived | An authenticated user of a shared n8n instance uses the public API to create a workflow node named '__proto__', then invokes the AI workflow builder's connect-nodes operation. The connection-merge logic copies the reserved key into the global Object prototype, polluting it and disrupting the n8n instance for all tenants until an administrator restarts the service. No public exploit code was identified, but the attack is straightforward given API access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Prototype pollution in the n8n AI workflow builder allows an authenticated user to degrade an instance until it is restarted by creating a workflow node whose name is a reserved key such as '__proto__' and then invoking the connect-nodes operation, which merges node connections using node names as object members without filtering reserved keys. Affected releases are all versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; the impact is availability-only (CVSS 6.0, C:N/I:N/A:H in the vendor's CVSS 4.0 vector; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity loss and no public exploit identified at time of analysis. Exploitation requires a valid account with the ability to create workflow nodes through the API and access to the AI workflow builder's connect-nodes operation, and it further depends on the attacker supplying the specific crafted node name, which is why the vendor's vector carries an AT:P attack-requirements value.
RemediationAI
Vendor-released patches: upgrade to n8n 1.123.83 on the 1.x line, 2.41.4 on the 2.4x line, or 2.42.1 or later on the 2.42.x line - these are the exact fixed versions stated in the advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-3p2g-2wpm-8h3g, and the VulnCheck write-up at https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-prototype-pollution-via-ai-workflow-builder-connection-merge lists the same boundaries. Because the bug lives in a merge routine that has no configuration switch, patching is the only complete fix. Until the upgrade can be scheduled, treat this as a privileged-insider and compromised-account hardening problem rather than a perimeter one: since exploitation requires an authenticated identity that can create workflow nodes and reach the AI workflow builder's connect-nodes operation, tighten n8n user and project roles so that only trusted operators hold node-creation and workflow-editing permissions, and remove or disable dormant accounts - the trade-off is reduced self-service for workflow authors. If the AI workflow builder is not in active use, restrict access to that feature for non-administrative roles; this removes the vulnerable code path entirely at the cost of disabling a convenience feature. Front the n8n API with a reverse proxy or API gateway that enforces IP allow-listing or mTLS for administrative endpoints, accepting the operational burden of managing client certificates or static address ranges. Monitor for workflows containing node names that match reserved JavaScript keys ('__proto__', 'constructor', 'prototype') as a detection signal, and note that restarting the n8n service will clear an already-polluted prototype, but it is a recovery step only - it does not prevent re-exploitation and causes an availability gap of its own. No vendor workaround other than patching is documented in the supplied references, and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is class CWE-1321 (improperly controlled modification of dynamically determined object attributes), the classic JavaScript prototype pollution pattern. n8n's AI workflow builder builds a connection graph by merging objects whose keys are taken directly from user-supplied node names. Because JavaScript resolves '__proto__' (and similar reserved keys such as 'constructor' or 'prototype') on the object prototype chain, a merge that does not reject these reserved property names assigns attacker-controlled values onto Object.prototype rather than onto an own property of the local merge target. Once Object.prototype is polluted, every subsequently created object in the Node.js runtime inherits the injected attribute, which can break application logic broadly and render the instance unusable until the process is restarted. There is no memory-corruption or code-execution primitive described here: the observable effect is a persistent, process-wide state change that manifests as an availability failure. The vulnerability is reachable only over the authenticated HTTP API surface that exposes node creation and the connect-nodes operation, and only in the named version ranges, which points to the connection-merge routine rather than the workflow execution engine as the root cause.
Know when Prototype Pollution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Authenticated API user (PR:L) sends a crafted reserved-key node name over the network (AV:N, AC:L); impact is availability-only (A:H) with no confidentiality or integrity loss and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. Rated critical severity (
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to co
This affects the package ini before 1.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
Exploit-DB