Prototype Pollution in n8n Workflow Automation

Executive Summary

CVE-2026-59206 is a Prototype Pollution vulnerability in the open-source workflow automation platform n8n. It affects versions prior to 1.123.61, 2.27.4, and 2.28.1. An authenticated user with the default workflow:create permission can craft a workflow that pollutes the Object.prototype when saved, updated, or imported via the workflow API.

This pollution allows unauthenticated requests to be treated as privileged users, exposing sensitive endpoints such as user and project listings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to authentication bypass, allowing unauthenticated attackers to gain privileged access.

• Exposure of sensitive information including personal data such as emails, user roles, and MFA status.
• Disclosure of all projects on the n8n instance to unauthorized users.
• Pollution of the global state which may cause parts of the instance to become unresponsive until a restart.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to gain privileged access to user and project listing endpoints, potentially exposing personal data such as emails, roles, and MFA status. Such unauthorized disclosure of personal data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Additionally, the corruption of global state causing parts of the instance to become unresponsive could impact the availability and integrity of data, which are also important aspects of compliance with these standards.

Mitigations such as patching to fixed versions or restricting workflow creation permissions to trusted users and limiting network access are necessary to maintain compliance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves prototype pollution via crafted workflows saved, updated, or imported through the workflow API by an authenticated user with workflow:create permission. Detection would involve monitoring for unusual or unauthorized workflow creation or modification activities, especially those that could manipulate Object.prototype.

Since the vulnerability allows unauthenticated requests to be treated as privileged users, monitoring for unexpected access to user and project listing endpoints by unauthenticated clients could indicate exploitation.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading n8n to a fixed version: 1.123.61, 2.27.4, or 2.28.1 or later.

As a temporary mitigation, restrict workflow creation permissions to trusted users only.

Additionally, limit network access to the n8n instance to prevent unauthorized access.

Useful 0 Not Useful 0