CVE-2026-110842: n8n: prototype pollution in MCP tool enables privilege escalation

UNKNOWN

Published October 14, 2026

CISO Take

n8n versions before 2.41.4 and 2.42.x before 2.42.1 have a prototype pollution flaw in the MCP workflow-validation tool. The tool evaluates caller-supplied code in the main server process. A low-privileged member holding only workflow:read can overwrite a built-in method so that server-side permission checks accept scopes the user does not hold, which can lead to takeover of owner accounts that lack MFA. No CVSS score, EPSS value, KEV listing or public exploit is available yet, so exploitation likelihood is unquantified. Because n8n is widely used to orchestrate AI agents and holds credentials for many downstream systems, owner takeover gives broad blast radius. Upgrade to 2.41.4 or 2.42.1 now, enforce MFA on all owner and admin accounts, and review who holds member accounts with MCP access.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Risk is high for any multi-user n8n instance that exposes the MCP feature, but the score is not yet published. The attacker must be authenticated with a minimal workflow:read grant, which is a low bar in shared or multi-tenant deployments. The effect is a complete authorization bypass, because the polluted prototype affects the shared process and not just the attacker's own session. Because code runs in the main process, the impact may extend beyond permission bypass to wider server compromise. Owner accounts protected by MFA are explicitly not affected by the described takeover path. There is no evidence of active exploitation or a public exploit, and no Nuclei template exists. Exposure is lower for single-user instances.

How does the attack unfold?

Initial Access

Attacker authenticates as a member with only a workflow:read grant.

AML.T0012

Exploitation

Crafted code sent to the MCP workflow-validation tool pollutes a shared prototype and replaces a built-in method with one returning truthy.

AML.T0053

Privilege Escalation

Server-side permission checks accept unheld scopes, allowing takeover of an owner account without MFA.

AML.T0106

Impact

Attacker accesses stored credentials, alters AI agent workflows and exfiltrates connected data.

AML.T0086

Initial Access

Attacker authenticates as a member with only a workflow:read grant.

AML.T0012

Exploitation

Crafted code sent to the MCP workflow-validation tool pollutes a shared prototype and replaces a built-in method with one returning truthy.

AML.T0053

Privilege Escalation

Server-side permission checks accept unheld scopes, allowing takeover of an owner account without MFA.

AML.T0106

Impact

Attacker accesses stored credentials, alters AI agent workflows and exfiltrates connected data.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade to n8n 2.41.4 or 2.42.1 or later. 2) Until patched, disable or restrict access to the MCP feature and workflow-validation tool where possible. 3) Enforce MFA on all owner and admin accounts. 4) Audit member accounts and remove unneeded workflow:read grants, especially for external or shared users. 5) Review audit logs for unusual MCP validation calls, unexpected permission changes, new owner sessions or password resets. 6) Rotate credentials stored in n8n if owner compromise is suspected. 7) Restrict network access to the n8n instance and put it behind SSO or a VPN.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentPluginFrameworkAML.T0012- Valid Accounts AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-110842?

Is CVE-2026-110842 actively exploited?

No confirmed active exploitation of CVE-2026-110842 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110842?

1) Upgrade to n8n 2.41.4 or 2.42.1 or later. 2) Until patched, disable or restrict access to the MCP feature and workflow-validation tool where possible. 3) Enforce MFA on all owner and admin accounts. 4) Audit member accounts and remove unneeded workflow:read grants, especially for external or shared users. 5) Review audit logs for unusual MCP validation calls, unexpected permission changes, new owner sessions or password resets. 6) Rotate credentials stored in n8n if owner compromise is suspected. 7) Restrict network access to the n8n instance and put it behind SSO or a VPN.

What systems are affected by CVE-2026-110842?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, MCP servers, LLM tool orchestration.

What is the CVSS score for CVE-2026-110842?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsMCP serversLLM tool orchestration

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.

Exploitation Scenario

An attacker obtains or is granted a low-privileged member account with workflow:read on a shared n8n instance. They call the MCP workflow-validation tool with crafted code that assigns a function returning true onto a shared prototype, replacing a built-in method used by permission checks. Server-side authorization then accepts scopes the attacker does not hold. The attacker uses the elevated access to reset or take over an owner account without MFA, then extracts stored credentials and modifies AI agent workflows to exfiltrate data or maintain persistence.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Primary CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.