Prototype Pollution Vulnerability in n8n by n8n-io

CVE-2026-118678

What is CVE-2026-118678?

Prior to versions 2.41.4 and 2.42.1, n8n is vulnerable to prototype pollution, which enables low-privileged users to manipulate the behavior of built-in objects. By incorporating specially named connection keys like 'proto' into workflows, attackers can disrupt system functionality. This manipulation may lead to failures in logins and data writes due to server errors triggered during the periodic history compaction task, thus compromising the integrity and reliability of the service.

References