Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n8n-io | n8n | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart. | |
| Title | n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge | |
| First Time appeared |
N8n
N8n n8n |
|
| Weaknesses | CWE-1321 | |
| CPEs | cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:* | |
| Vendors & Products |
N8n
N8n n8n |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T22:52:23.952Z
Reserved: 2026-10-14T22:12:22.055Z
Link: CVE-2026-110848
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-14T23:17:25.563
Modified: 2026-10-14T23:17:25.673
Link: CVE-2026-110848
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')