CVE-2026-118678: n8n prototype pollution

CISO Take

n8n before 2.41.4 (and 2.42.x before 2.42.1) has a prototype pollution flaw. Any low-privileged user who can save workflows can add a connection key such as __proto__, and the periodic history compaction task then processes it and breaks logins and writes with server errors. The impact is availability only (CVSS 7.1, with limited integrity impact and no confidentiality loss). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so near-term mass exploitation looks unlikely. The risk is highest for multi-tenant or shared n8n instances where many users hold workflow-edit rights, because one insider or compromised account can take down the automation platform that orchestrates your AI agents. Upgrade to 2.41.4 or 2.42.1 or later, and review who has permission to create or edit workflows.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium-high. The attack is network-reachable, low complexity, needs low privileges and no user interaction (CVSS 7.1). Impact is high on availability and low on integrity, with no confidentiality impact. Exploitation requires an authenticated account with workflow-save rights, which limits exposure to insiders, shared tenants and compromised low-privilege accounts. No public exploit, KEV listing or SSVC decision exists as of publication, and EPSS data is unavailable. The advisory is on GitHub and VulnCheck, so a proof of concept is easy to derive from the description. Persistence matters here: once the poisoned workflow is saved, the compaction task keeps failing until the data is cleaned or the service is patched.

How does the attack unfold?

Initial Access

Attacker authenticates to n8n with a low-privileged account that can save workflows.

AML.T0012

Exploitation

Attacker saves a workflow whose connection keys include __proto__, polluting object prototypes when processed.

AML.T0049

Trigger

The periodic history compaction task processes the poisoned connection keys and corrupts built-in object behaviour.

Impact

Logins and writes fail with server errors, taking down AI agent workflows and automations.

AML.T0029

Initial Access

Attacker authenticates to n8n with a low-privileged account that can save workflows.

AML.T0012

Exploitation

Attacker saves a workflow whose connection keys include __proto__, polluting object prototypes when processed.

AML.T0049

Trigger

The periodic history compaction task processes the poisoned connection keys and corrupts built-in object behaviour.

Impact

Logins and writes fail with server errors, taking down AI agent workflows and automations.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

AHigh

What should I do?

1 step

1) Upgrade n8n to 2.41.4 or 2.42.1 or later. 2) Until patched, restrict workflow create and edit permissions to trusted users and remove unused or low-privilege accounts. 3) Audit saved workflows and workflow history for connection keys named __proto__, constructor or prototype, and remove any you find. 4) Monitor n8n logs for repeated server errors from the history compaction task and for login or write failures. 5) Alert on workflow saves that contain unusual connection key names. 6) Keep database backups so you can restore a clean state if poisoned workflow history blocks recovery. 7) Put the instance behind SSO and network restrictions to reduce the number of accounts that can reach the editor.

How is it classified?

DoSFrameworkAgentAML.T0012- Valid Accounts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and failures

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118678?

n8n before 2.41.4 (and 2.42.x before 2.42.1) has a prototype pollution flaw. Any low-privileged user who can save workflows can add a connection key such as __proto__, and the periodic history compaction task then processes it and breaks logins and writes with server errors. The impact is availability only (CVSS 7.1, with limited integrity impact and no confidentiality loss). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so near-term mass exploitation looks unlikely. The risk is highest for multi-tenant or shared n8n instances where many users hold workflow-edit rights, because one insider or compromised account can take down the automation platform that orchestrates your AI agents. Upgrade to 2.41.4 or 2.42.1 or later, and review who has permission to create or edit workflows.

Is CVE-2026-118678 actively exploited?

No confirmed active exploitation of CVE-2026-118678 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118678?

1) Upgrade n8n to 2.41.4 or 2.42.1 or later. 2) Until patched, restrict workflow create and edit permissions to trusted users and remove unused or low-privilege accounts. 3) Audit saved workflows and workflow history for connection keys named __proto__, constructor or prototype, and remove any you find. 4) Monitor n8n logs for repeated server errors from the history compaction task and for login or write failures. 5) Alert on workflow saves that contain unusual connection key names. 6) Keep database backups so you can restore a clean state if poisoned workflow history blocks recovery. 7) Put the instance behind SSO and network restrictions to reduce the number of accounts that can reach the editor.

What systems are affected by CVE-2026-118678?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, multi-tenant automation hubs.

What is the CVSS score for CVE-2026-118678?

CVE-2026-118678 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelinesmulti-tenant automation hubs

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.

Exploitation Scenario

An attacker with a low-privilege account on a shared n8n instance, for example a contractor or a compromised user token, saves a workflow whose connections object includes a __proto__ key. The workflow looks harmless and no execution is needed. When the scheduled history compaction task runs, it processes the key and pollutes the built-in object prototype. Afterwards, logins and database writes begin failing with server errors across the instance. The company's AI agent workflows, LLM pipelines and alert-routing automations stop working until administrators find and remove the poisoned workflow or apply the patch.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Primary CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.