CVE-2026-86078CWE-1321

CVE-2026-86078

Medium · published September 9, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00586 · 47.3th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-09-09T02:19Z
Affected products (2)
ProductVersionsFixed in
n8n/n8n< 2.37.72.37.7
n8n/n8n≥ 2.38.0, < 2.38.22.38.2
References (3)
https://github.com/n8n-io/n8n/releases/tag/[email protected] · [email protected]https://github.com/n8n-io/n8n/releases/tag/[email protected] · [email protected]https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 21:27Z
    n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
    cvelistv5