PT-2026-40933 · N8N · N8N

Published 2026-05-14 · Updated 2026-05-21 · CVE-2026-44789

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.43 n8n versions prior to 2.20.7 n8n versions prior to 2.22.1

Description An authenticated user with permissions to create or modify workflows can achieve global prototype pollution through an unvalidated pagination parameter in the HTTP Request node. Prototype pollution occurs when an application allows an attacker to modify the prototype of a base object, potentially altering the behavior of all objects created from that prototype. This issue can be combined with other techniques to result in Remote Code Execution (RCE) on the instance.

Recommendations Update to version 1.123.43 or later. Update to version 2.20.7 or later. Update to version 2.22.1 or later. Limit workflow creation and editing permissions to fully trusted users only. Disable the HTTP Request node by adding n8n-nodes-base.httpRequest to the NODES EXCLUDE environment variable.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-44789

GHSA-C8XV-5998-G76H

Affected Products

N8N

References · 9

• https://osv.dev/vulnerability/GHSA-c8xv-5998-g76h · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-c8xv-5998-g76h · Note
• https://reddit.com/r/CVEWatch/comments/1tjfwja/top_10_trending_cves_21052026 · Reddit Post
• https://twitter.com/Netlas_io/status/2057031576375226702 · Twitter Post
• https://t.me/CSIRT_italia/3518 · Telegram Post
• https://twitter.com/UpwindMDR/status/2054876407382036673 · Twitter Post
• https://twitter.com/trerbbb/status/2056384396005949731 · Twitter Post
• https://t.me/netlas/570 · Telegram Post