CVE-2026-110848: n8n prototype pollution

CISO Take

n8n's AI workflow builder merges workflow connections using node names as object keys without blocking reserved keys. An authenticated user can create a node named __proto__ and trigger the connect-nodes operation, which pollutes the global object prototype and disrupts the whole instance until it is restarted. No CVSS score, EPSS data, KEV listing, public exploit or Nuclei template exists yet, so exploitation likelihood is unquantified, but the attack needs only a valid low-privilege account and a few API calls. The impact is availability-focused, though it hits every workflow on a shared instance, including AI agents and automations that run business processes. Upgrade to 1.123.83, 2.41.4 or 2.42.1 (or later), review who holds accounts on your n8n instances, and alert on workflows containing nodes named __proto__.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Moderate, with severity not yet scored. Exploitation requires authentication, but the technique is simple, and any editor-level or compromised account can trigger it. Prototype pollution (CWE-1321) can sometimes escalate beyond denial of service depending on gadgets in the Node.js process, but the advisory only describes disruption until restart. No known active exploitation, no public PoC, and no KEV or SSVC data as of publication. Exposure is highest for multi-user or multi-tenant n8n deployments and instances where untrusted users can use the AI workflow builder.

How does the attack unfold?

Initial Access

Attacker authenticates to n8n with a low-privilege or stolen account that can create workflows via the API.

AML.T0012

Exploitation

Attacker creates a node named __proto__ and invokes the connect-nodes operation, so the merge writes into Object.prototype.

AML.T0049

Impact

The polluted global prototype disrupts the Node.js process, halting all workflows and AI agents until restart.

AML.T0029

Initial Access

Attacker authenticates to n8n with a low-privilege or stolen account that can create workflows via the API.

AML.T0012

Exploitation

Attacker creates a node named __proto__ and invokes the connect-nodes operation, so the merge writes into Object.prototype.

AML.T0049

Impact

The polluted global prototype disrupts the Node.js process, halting all workflows and AI agents until restart.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade n8n to 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, restrict the AI workflow builder and workflow-creation permissions to trusted users, and disable or limit self-registration and shared accounts. 3) Review workflows and API audit logs for nodes named __proto__, constructor or prototype and for unexpected connect-nodes calls. 4) Monitor instance health and set up automatic restart and alerting on abnormal process behavior or errors. 5) Place n8n behind SSO and network controls so only vetted users can reach the API. 6) Follow GHSA-3p2g-2wpm-8h3g and the VulnCheck advisory for updates, including any later scoring.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAgentFrameworkAML.T0012- Valid Accounts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110848?

n8n's AI workflow builder merges workflow connections using node names as object keys without blocking reserved keys. An authenticated user can create a node named __proto__ and trigger the connect-nodes operation, which pollutes the global object prototype and disrupts the whole instance until it is restarted. No CVSS score, EPSS data, KEV listing, public exploit or Nuclei template exists yet, so exploitation likelihood is unquantified, but the attack needs only a valid low-privilege account and a few API calls. The impact is availability-focused, though it hits every workflow on a shared instance, including AI agents and automations that run business processes. Upgrade to 1.123.83, 2.41.4 or 2.42.1 (or later), review who holds accounts on your n8n instances, and alert on workflows containing nodes named __proto__.

Is CVE-2026-110848 actively exploited?

No confirmed active exploitation of CVE-2026-110848 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110848?

1) Upgrade n8n to 1.123.83, 2.41.4, 2.42.1 or later. 2) Until patched, restrict the AI workflow builder and workflow-creation permissions to trusted users, and disable or limit self-registration and shared accounts. 3) Review workflows and API audit logs for nodes named __proto__, constructor or prototype and for unexpected connect-nodes calls. 4) Monitor instance health and set up automatic restart and alerting on abnormal process behavior or errors. 5) Place n8n behind SSO and network controls so only vetted users can reach the API. 6) Follow GHSA-3p2g-2wpm-8h3g and the VulnCheck advisory for updates, including any later scoring.

What systems are affected by CVE-2026-110848?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines.

What is the CVSS score for CVE-2026-110848?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

Exploitation Scenario

An attacker with a low-privilege editor account, whether a malicious insider or a user whose credentials were phished or stolen, calls the n8n API to create a workflow containing a node named __proto__. They then invoke the AI workflow builder's connect-nodes operation, which merges connections into an object keyed by node name and writes into Object.prototype. The Node.js process starts failing across unrelated workflows, halting AI agents and automations until an administrator restarts the instance. The attacker can repeat the action after each restart to keep the service down.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Primary CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.