PT-2026-50172 · N8N · N8N
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 2.25.7
n8n versions prior to 2.26.2
Description
A prototype pollution issue allows a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially altering the behavior of the application. These injected fields can be consumed as normal values by downstream built-in nodes. In workflows combining a public webhook with action nodes, this can lead to a confused deputy scenario, where the workflow targets unintended records or issues outbound requests using the workflow owner's configured credentials.
Recommendations
Update to version 2.25.7 or later.
Update to version 2.26.2 or later.
Avoid exposing public unauthenticated webhook workflows that pass incoming data through transform nodes into action nodes with sensitive credentials or database operations.
Limit workflow creation and editing permissions to fully trusted users only.
Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N