CVE-2026-118649: n8n prototype pollution bypasses

CISO Take

CVE-2026-118649 is an authorization bypass in n8n's Data Tables feature: the platform caches each workflow's owner project by a client-supplied workflow ID, so a crafted ID such as __proto__ (CWE-1321, prototype pollution) makes the project ownership check match every project. Any authenticated member who can create and run workflows can then list, read, modify and delete Data Table rows across all projects on the instance, defeating the tenant and team isolation that organizations rely on. It is rated High (CVSS 8.3) and is network-reachable with low complexity, low privileges and no user interaction. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, but the trigger value is publicly documented in the advisory, so exploitation is trivial for any insider or compromised low-privilege account. Upgrade to n8n 2.43.5 or 2.44.1 or later, restrict workflow-creation rights to trusted users until patched, and review Data Table access logs for unusual cross-project reads or deletions.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. Exploitation requires only a valid low-privilege member account with workflow create and execute rights, and the attack is network-based with low complexity and no user interaction. Confidentiality and integrity impact is high because Data Table contents from every project become readable and writable; availability impact is low (row deletion). The exposure is greatest in multi-project or multi-team n8n instances, and on instances where workflow-builder access is broadly granted or self-registration or SSO onboarding is open. No active exploitation, KEV listing, public exploit or EPSS data is available at publication, so the real-world likelihood is uncertain but the barrier to exploit is low. The reported exposure was not measured here (downstream dependents and package risk data are unknown).

How does the attack unfold?

Initial Access

Attacker logs in with a low-privilege n8n member account that can create and run workflows.

AML.T0012

Exploitation

Attacker supplies a crafted workflow ID such as __proto__ so the cached project-owner check matches every project.

AML.T0049

Collection

Attacker lists and reads Data Table rows from all projects on the instance.

AML.T0036

Impact

Attacker modifies or deletes rows, corrupting data that AI agents and workflows depend on.

Initial Access

Attacker logs in with a low-privilege n8n member account that can create and run workflows.

AML.T0012

Exploitation

Attacker supplies a crafted workflow ID such as __proto__ so the cached project-owner check matches every project.

AML.T0049

Collection

Attacker lists and reads Data Table rows from all projects on the instance.

AML.T0036

Impact

Attacker modifies or deletes rows, corrupting data that AI agents and workflows depend on.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Upgrade n8n to 2.43.5 or later on the 2.43 line, or to 2.44.1 or later on the 2.44 line. 2) Until patched, limit who can create and run workflows to trusted users, and disable or tighten self-registration and invitation flows. 3) Audit existing members and remove unneeded accounts or roles. 4) Review n8n execution history and logs for workflows with unusual or special workflow IDs (for example __proto__, constructor or prototype) and for Data Table operations that cross project boundaries. 5) Back up Data Tables and verify the integrity of rows that feed AI agents or decisions, then restore from backup if tampering is found. 6) Consider network-level restrictions on the n8n editor and API to trusted networks or VPN, and rotate any secrets stored in Data Tables if cross-project access cannot be ruled out.

How is it classified?

Auth BypassData LeakageAgentFrameworkAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and manage previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118649?

CVE-2026-118649 is an authorization bypass in n8n's Data Tables feature: the platform caches each workflow's owner project by a client-supplied workflow ID, so a crafted ID such as __proto__ (CWE-1321, prototype pollution) makes the project ownership check match every project. Any authenticated member who can create and run workflows can then list, read, modify and delete Data Table rows across all projects on the instance, defeating the tenant and team isolation that organizations rely on. It is rated High (CVSS 8.3) and is network-reachable with low complexity, low privileges and no user interaction. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, but the trigger value is publicly documented in the advisory, so exploitation is trivial for any insider or compromised low-privilege account. Upgrade to n8n 2.43.5 or 2.44.1 or later, restrict workflow-creation rights to trusted users until patched, and review Data Table access logs for unusual cross-project reads or deletions.

Is CVE-2026-118649 actively exploited?

No confirmed active exploitation of CVE-2026-118649 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118649?

1) Upgrade n8n to 2.43.5 or later on the 2.43 line, or to 2.44.1 or later on the 2.44 line. 2) Until patched, limit who can create and run workflows to trusted users, and disable or tighten self-registration and invitation flows. 3) Audit existing members and remove unneeded accounts or roles. 4) Review n8n execution history and logs for workflows with unusual or special workflow IDs (for example __proto__, constructor or prototype) and for Data Table operations that cross project boundaries. 5) Back up Data Tables and verify the integrity of rows that feed AI agents or decisions, then restore from backup if tampering is found. 6) Consider network-level restrictions on the n8n editor and API to trusted networks or VPN, and rotate any secrets stored in Data Tables if cross-project access cannot be ruled out.

What systems are affected by CVE-2026-118649?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation platforms, Multi-tenant AI orchestration, LLM-driven business automation pipelines.

What is the CVSS score for CVE-2026-118649?

CVE-2026-118649 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation platformsMulti-tenant AI orchestrationLLM-driven business automation pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

Exploitation Scenario

An attacker holds a low-privilege member account on a shared n8n instance, for example a contractor or a compromised employee login. They create a workflow, or call the API, supplying the workflow ID __proto__ when running a Data Table operation. The cached project-ownership lookup then returns a value that matches every project, so the authorization check passes. The attacker lists Data Tables belonging to other teams, reads rows containing customer data or agent configuration, edits rows that an AI agent workflow uses to make decisions, and deletes tables to cause disruption.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Primary CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.