CVE-2026-110848CWE-1321

CVE-2026-110848

published October 15, 2026

CVSS
6.0
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-10-15T03:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-3p2g-2wpm-8h3g · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-prototype-pollution-via-ai-workflow-builder-connection-merge · [email protected]
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 14 OCT 22:52Z
    n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
    cvelistv5
  • 14 OCT 22:52Z
    n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
    cvelistv5