CVE-2026-86078: n8n prototype pollution

Q: Is CVE-2026-86078 actively exploited?

No confirmed active exploitation of CVE-2026-86078 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86078?

Upgrade to n8n 2.37.7 or 2.38.2 immediately — both contain the fix per GHSA-679f-58pq-4v2c and the linked GitHub release notes. Until patched, restrict who can create or import workflows via the REST API to trusted, vetted users, since exploitation depends on that access path. Add input validation or a sanitizing proxy in front of workflow-creation endpoints to reject payloads containing `__proto__`, `constructor`, or `prototype` as node names or connection keys. Monitor n8n application logs and error rates for anomalous instability or unexplained request failures following workflow imports, which can be a symptom of prototype pollution taking effect. On multi-tenant instances, consider isolating tenants into separate n8n processes/containers as a longer-term compensating control against this class of cross-tenant disruption.

Q: What systems are affected by CVE-2026-86078?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms.

Q: What is the CVSS score for CVE-2026-86078?

No CVSS score has been assigned yet.

CISO Take

A flaw in n8n's Instance AI workflow-summarization feature lets a user submit a workflow via the REST API with a node name or connection key of __proto__ or constructor, letting nested writes reach JavaScript's Object.prototype inside the main n8n process. There's no CVSS score, no CISA KEV listing, no EPSS data, and no public exploit or scanner template for this issue, and package risk scoring shows 0/100 — this reads as a low-noise, low-urgency bug rather than an active threat. The real concern for CISOs is blast radius on shared/multi-tenant n8n instances: because the pollution lands in a process-wide object, one user's crafted workflow can disrupt other users' subsequent requests on the same instance, which is an availability and data-integrity risk more than a confidentiality one. Patch to 2.37.7 or 2.38.2 now — it's a straightforward version bump — and in the interim, review who has REST API workflow-creation access, since exploitation requires that level of access rather than anonymous internet exposure. Given the absence of active exploitation signals, this does not warrant a breaking alert, but should be tracked in standard patch cadence for any self-hosted or cloud n8n instance running the AI workflow summary feature.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity as labeled by the vendor, with no published CVSS vector, no EPSS score, and no CISA KEV listing — all of which point to low observed or predicted exploitation activity. Exploitation requires the ability to submit a workflow via n8n's REST API (i.e., an authenticated or otherwise privileged actor within the n8n instance), which narrows the realistic attacker population compared to an unauthenticated, internet-facing bug. The impact described is process-wide disruption of subsequent requests rather than direct code execution, data exfiltration, or credential theft, though prototype pollution vulnerabilities in Node.js applications can sometimes be chained into more severe outcomes if exploitable gadgets exist elsewhere in the codebase — none are confirmed here. No public exploit code or Nuclei template exists, and there is no evidence of in-the-wild exploitation.

How does the attack unfold?

Malicious workflow submission

An attacker with REST API access submits a workflow containing __proto__ or constructor as a node name or connection key.

AML.T0049

Prototype pollution trigger

summarizeWorkflowStructure uses these unsanitized keys as plain object keys during AI summary generation, causing nested writes to reach Object.prototype in the main n8n process.

Instance-wide disruption

The polluted prototype corrupts shared process state, disrupting or breaking subsequent requests handled by the same n8n instance until it is restarted or patched.

Malicious workflow submission

An attacker with REST API access submits a workflow containing __proto__ or constructor as a node name or connection key.

AML.T0049

Prototype pollution trigger

summarizeWorkflowStructure uses these unsanitized keys as plain object keys during AI summary generation, causing nested writes to reach Object.prototype in the main n8n process.

Instance-wide disruption

The polluted prototype corrupts shared process state, disrupting or breaking subsequent requests handled by the same n8n instance until it is restarted or patched.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.38.0, < 2.38.2	`2.38.2`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to n8n 2.37.7 or 2.38.2 immediately — both contain the fix per GHSA-679f-58pq-4v2c and the linked GitHub release notes. Until patched, restrict who can create or import workflows via the REST API to trusted, vetted users, since exploitation depends on that access path. Add input validation or a sanitizing proxy in front of workflow-creation endpoints to reject payloads containing __proto__, constructor, or prototype as node names or connection keys. Monitor n8n application logs and error rates for anomalous instability or unexplained request failures following workflow imports, which can be a symptom of prototype pollution taking effect. On multi-tenant instances, consider isolating tenants into separate n8n processes/containers as a longer-term compensating control against this class of cross-tenant disruption.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-86078?

A flaw in n8n's Instance AI workflow-summarization feature lets a user submit a workflow via the REST API with a node name or connection key of __proto__ or constructor, letting nested writes reach JavaScript's Object.prototype inside the main n8n process. There's no CVSS score, no CISA KEV listing, no EPSS data, and no public exploit or scanner template for this issue, and package risk scoring shows 0/100 — this reads as a low-noise, low-urgency bug rather than an active threat. The real concern for CISOs is blast radius on shared/multi-tenant n8n instances: because the pollution lands in a process-wide object, one user's crafted workflow can disrupt other users' subsequent requests on the same instance, which is an availability and data-integrity risk more than a confidentiality one. Patch to 2.37.7 or 2.38.2 now — it's a straightforward version bump — and in the interim, review who has REST API workflow-creation access, since exploitation requires that level of access rather than anonymous internet exposure. Given the absence of active exploitation signals, this does not warrant a breaking alert, but should be tracked in standard patch cadence for any self-hosted or cloud n8n instance running the AI workflow summary feature.

Is CVE-2026-86078 actively exploited?

No confirmed active exploitation of CVE-2026-86078 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86078?

Upgrade to n8n 2.37.7 or 2.38.2 immediately — both contain the fix per GHSA-679f-58pq-4v2c and the linked GitHub release notes. Until patched, restrict who can create or import workflows via the REST API to trusted, vetted users, since exploitation depends on that access path. Add input validation or a sanitizing proxy in front of workflow-creation endpoints to reject payloads containing `__proto__`, `constructor`, or `prototype` as node names or connection keys. Monitor n8n application logs and error rates for anomalous instability or unexplained request failures following workflow imports, which can be a symptom of prototype pollution taking effect. On multi-tenant instances, consider isolating tenants into separate n8n processes/containers as a longer-term compensating control against this class of cross-tenant disruption.

What systems are affected by CVE-2026-86078?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration platforms.

What is the CVSS score for CVE-2026-86078?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.

Exploitation Scenario

An attacker who holds a low-privilege but valid account on a shared n8n instance crafts a workflow JSON where a node's name (or a connection key) is set to `__proto__` with a nested malicious property, then submits it through n8n's REST API. When the Instance AI feature later calls `summarizeWorkflowStructure` to generate a summary of stored workflows, the code uses these attacker-controlled node/connection names as plain object keys without sanitization, causing the nested write to traverse into `Object.prototype` inside the shared main n8n process. Because the pollution affects the process's global object prototype rather than just the attacker's own session, subsequent unrelated requests handled by that same n8n process — potentially belonging to other users or workflows, including AI agent automations — begin behaving unexpectedly or failing, producing a denial-of-service-like disruption across the instance until it is restarted or patched.

Weaknesses (CWE)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Primary CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Primary CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.