CVE-2026-59206: n8n prototype pollution lets guests

Q: Is CVE-2026-59206 actively exploited?

No confirmed active exploitation of CVE-2026-59206 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59206?

Upgrade to n8n 1.123.61, 2.27.4, or 2.28.1 immediately — this is the only complete fix. Until patched, restrict the workflow:create permission to fully trusted users and disable self-service workflow creation for external or lower-trust accounts. Audit recently created, updated, or imported workflows for unusual or malformed JSON structures targeting __proto__ or constructor.prototype keys. Monitor access logs for unauthenticated requests successfully reaching user-listing or project-listing endpoints, which would indicate active exploitation. Review the GitHub Security Advisory (GHSA-75qm-gp28-rcq9) for IOCs as they become available.

Q: What systems are affected by CVE-2026-59206?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms.

Q: What is the CVSS score for CVE-2026-59206?

CVE-2026-59206 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.66%.

CISO Take

A low-privilege n8n user with the default workflow:create permission can craft a workflow that pollutes JavaScript's global Object.prototype when it is saved, updated, or imported via the workflow API, and once triggered this causes the server to treat completely unauthenticated requests as if they came from a privileged user, exposing internal user and project listing endpoints. n8n is a widely deployed workflow and AI-agent orchestration platform with 129 other CVEs on record and an OpenSSF Scorecard of only 6.6/10, and this bug needs only network access, low privileges, and no user interaction (CVSS 7.1, AC:L/PR:L/UI:N) — the barrier to entry is any valid low-tier account, which many self-service or multi-tenant n8n deployments hand out freely to collaborators or contractors. There is no public exploit or Nuclei template yet and it is not in CISA KEV, keeping EPSS low (0.3%, 78th percentile), but the confidentiality impact is high and the technique — an insider or compromised low-priv account escalating unauthenticated requests to org/user data — is trivial to weaponize once a PoC surfaces. Patch immediately to n8n 1.123.61, 2.27.4, or 2.28.1; if that's not immediately possible, restrict workflow:create to trusted users only and monitor for anomalous unauthenticated calls to user/project listing endpoints as a compensating control.

Sources: NVD GitHub Advisory EPSS OpenSSF ATLAS

What is the risk?

High risk despite the absence of active exploitation. The attack requires only a low-privileged authenticated account (a permission tier commonly granted broadly in team n8n instances) and no user interaction, with low attack complexity over the network. The confidentiality impact is high (user/project enumeration bypassing auth), though integrity and availability impact are limited. EPSS sits at the 78th percentile, meaning it's more likely to be exploited than most CVEs in the corpus even without a public PoC, and prototype pollution bugs are well-understood by attackers, making weaponization straightforward once details circulate. The lack of downstream dependents in this scan understates real exposure — n8n is typically deployed as a standalone orchestration server, not consumed as a library.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege n8n account with default workflow:create permission.

AML.T0049

Exploitation

Attacker saves, updates, or imports a crafted workflow via the API that pollutes the global Object.prototype.

Privilege Escalation

The polluted prototype causes subsequent unauthenticated requests to be treated as privileged, bypassing authentication checks.

Impact

Attacker enumerates exposed user and project listing endpoints, harvesting tenant and organizational data.

Initial Access

Attacker obtains a low-privilege n8n account with default workflow:create permission.

AML.T0049

Exploitation

Attacker saves, updates, or imports a crafted workflow via the API that pollutes the global Object.prototype.

Privilege Escalation

The polluted prototype causes subsequent unauthenticated requests to be treated as privileged, bypassing authentication checks.

Impact

Attacker enumerates exposed user and project listing endpoints, harvesting tenant and organizational data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.61	`1.123.61`
201.9K OpenSSF 6.7 Pushed 3d ago 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A Low

What should I do?

1 step

Upgrade to n8n 1.123.61, 2.27.4, or 2.28.1 immediately — this is the only complete fix. Until patched, restrict the workflow:create permission to fully trusted users and disable self-service workflow creation for external or lower-trust accounts. Audit recently created, updated, or imported workflows for unusual or malformed JSON structures targeting __proto__ or constructor.prototype keys. Monitor access logs for unauthenticated requests successfully reaching user-listing or project-listing endpoints, which would indicate active exploitation. Review the GitHub Security Advisory (GHSA-75qm-gp28-rcq9) for IOCs as they become available.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent Framework API AML.T0047 - AI-Enabled Product or Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.8 - AI system security controls

NIST AI RMF

MANAGE 4.1 - Risk monitoring and response for deployed AI systems

Frequently Asked Questions

What is CVE-2026-59206?

A low-privilege n8n user with the default workflow:create permission can craft a workflow that pollutes JavaScript's global Object.prototype when it is saved, updated, or imported via the workflow API, and once triggered this causes the server to treat completely unauthenticated requests as if they came from a privileged user, exposing internal user and project listing endpoints. n8n is a widely deployed workflow and AI-agent orchestration platform with 129 other CVEs on record and an OpenSSF Scorecard of only 6.6/10, and this bug needs only network access, low privileges, and no user interaction (CVSS 7.1, AC:L/PR:L/UI:N) — the barrier to entry is any valid low-tier account, which many self-service or multi-tenant n8n deployments hand out freely to collaborators or contractors. There is no public exploit or Nuclei template yet and it is not in CISA KEV, keeping EPSS low (0.3%, 78th percentile), but the confidentiality impact is high and the technique — an insider or compromised low-priv account escalating unauthenticated requests to org/user data — is trivial to weaponize once a PoC surfaces. Patch immediately to n8n 1.123.61, 2.27.4, or 2.28.1; if that's not immediately possible, restrict workflow:create to trusted users only and monitor for anomalous unauthenticated calls to user/project listing endpoints as a compensating control.

Is CVE-2026-59206 actively exploited?

No confirmed active exploitation of CVE-2026-59206 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59206?

Upgrade to n8n 1.123.61, 2.27.4, or 2.28.1 immediately — this is the only complete fix. Until patched, restrict the workflow:create permission to fully trusted users and disable self-service workflow creation for external or lower-trust accounts. Audit recently created, updated, or imported workflows for unusual or malformed JSON structures targeting __proto__ or constructor.prototype keys. Monitor access logs for unauthenticated requests successfully reaching user-listing or project-listing endpoints, which would indicate active exploitation. Review the GitHub Security Advisory (GHSA-75qm-gp28-rcq9) for IOCs as they become available.

What systems are affected by CVE-2026-59206?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms.

What is the CVSS score for CVE-2026-59206?

CVE-2026-59206 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration platforms

MITRE ATLAS Techniques

AML.T0047 AI-Enabled Product or Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.8

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

Exploitation Scenario

An attacker obtains or already holds a low-privilege n8n account with the default workflow:create permission (e.g., a contractor, a compromised low-tier credential, or a self-service signup in a permissive tenant). They craft a workflow JSON payload containing keys designed to pollute Object.prototype (e.g., via __proto__ or constructor.prototype chains) and save, update, or import it through the workflow API. The polluted prototype then affects global object behavior across the Node.js process, causing the server's authorization checks to misclassify subsequent unauthenticated requests as privileged. The attacker (or anyone) then sends unauthenticated requests to user and project listing endpoints, harvesting tenant user lists and project metadata for further targeting or lateral movement.

Weaknesses (CWE)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Primary CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Primary CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.