Workflow Automation Vulnerability in n8n by n8n Inc.
CVE-2026-86078

6MEDIUM

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
8 September 2026

What is CVE-2026-86078?

The n8n workflow automation platform contains a vulnerability that allows an attacker to exploit the Instance AI workflow summary feature. Specifically, prior to versions 2.37.7 and 2.38.2, inadequately handled data from submitted workflows could lead to the modification of Object.prototype due to the use of proto or constructor keys. This can disrupt the function of the n8n process and affect subsequent requests, highlighting a security risk for users relying on the platform for automation tasks. The issue has been resolved in the later versions mentioned above.

Affected Version(s)

n8n < 2.37.7 < 2.37.7

n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-67...
x_refsource_CONFIRM
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
x_refsource_MISC
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.