Prototype Pollution Vulnerability in n8n Workflow Automation Platform
CVE-2026-44789
9.4CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-44789?
An authenticated user with permissions to create or modify workflows in n8n prior to versions 1.123.43, 2.22.1, and 2.20.7 could exploit an unvalidated pagination parameter within the HTTP Request node to perform global prototype pollution. This vulnerability poses a risk of remote code execution (RCE) when combined with other attack vectors, potentially compromising the integrity of the n8n instance.
Affected Version(s)
n8n < 1.123.43 < 1.123.43
n8n >= 2.0.0-rc.0, < 2.20.7 < 2.0.0-rc.0, 2.20.7
n8n >= 2.21.0, < 2.21.1 < 2.21.0, 2.21.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.