PT-2026-50178 · N8N · N8N

S2Ongmo · CVE-2026-54312 · Published 2026-06-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.24.0

Description An authenticated user with permissions to create or modify workflows can achieve global prototype pollution through the Microsoft SQL node. By providing a crafted value to the table parameter, the Object.prototype is polluted process-wide for the duration of the server process. This leads to application-wide validation failures, rendering the instance completely non-functional until it is restarted. Prototype pollution is a technique where an attacker manipulates the prototype of base object classes to inject properties that are inherited by all objects in the application.

Recommendations Update to version 2.24.0. Limit workflow creation and editing permissions to fully trusted users only. Disable the Microsoft SQL node by adding n8n-nodes-base.microsoftSql to the NODES EXCLUDE environment variable.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-54312

GHSA-X6P3-M6H9-FX7R

Affected Products

N8N

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54312.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54312 · Security Note
• https://osv.dev/vulnerability/GHSA-x6p3-m6h9-fx7r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54312 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-54312 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://t.me/cveNotify/175934 · Telegram Post
• https://t.me/cveNotify/173308 · Telegram Post