Prototype Pollution Vulnerability in n8n Workflow Automation Platform

CVE-2026-54306

What is CVE-2026-54306?

n8n, an open-source workflow automation platform, is susceptible to a prototype pollution vulnerability that impacts versions before 2.25.7 and 2.26.2. This vulnerability arises from the handling of crafted public webhook payloads, enabling attackers to inject fields that they control into the internal workflow data. As these fields are integrated and processed by downstream built-in nodes, they could allow an attacker to manipulate the workflow into acting as a confused deputy. This could ultimately lead to unauthorized access to sensitive records or the execution of outbound requests through the workflow owner's credentials. The issue has been addressed in subsequent versions to safeguard users against such threats.

References