CVE-2026-54306: n8n Prototype Pollution Vulnerability

CVE-2026-54306 Overview

CVE-2026-54306 is a prototype pollution vulnerability in n8n, an open source workflow automation platform. Versions prior to 2.25.7 and 2.26.2 allow a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. Downstream built-in nodes then surface and consume these polluted fields as legitimate values. Workflows that combine a public webhook trigger with action nodes consuming the resulting fields become confused deputies. An attacker can target unintended records or issue outbound requests using the workflow owner's configured credentials. The vulnerability is tracked under CWE-1321 and fixed in 2.25.7 and 2.26.2.

Critical Impact
Attackers can manipulate workflow execution to abuse the owner's stored credentials, perform unauthorized record access, or trigger outbound requests to attacker-chosen destinations.

Affected Products

n8n workflow automation platform versions prior to 2.25.7
n8n workflow automation platform versions prior to 2.26.2
Workflows exposing a public webhook trigger combined with action nodes consuming webhook fields

Discovery Timeline

2026-06-23 - CVE-2026-54306 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54306

Vulnerability Analysis

The flaw is a prototype pollution issue classified under CWE-1321. n8n performs internal object copying on incoming public webhook payloads without sanitizing keys such as __proto__, constructor, or prototype. A crafted payload injects properties onto the base Object.prototype, which the JavaScript runtime then exposes on every subsequent object in the workflow execution context.

Downstream nodes that read fields from workflow data inherit the attacker-controlled values when the underlying source object lacks an explicit property. The nodes treat the polluted fields as legitimate input. This converts a benign webhook into a control channel for any action node further along the workflow.

Because workflows execute under the owner's identity, action nodes use the owner's stored credentials. An attacker without authentication can therefore steer outbound HTTP requests, database queries, or third-party API calls toward unintended targets. The CVSS 4.0 base score is 6.3 reflecting low confidentiality, low integrity, and subsequent system impact across both the vulnerable component and connected services.

Root Cause

The internal object-copy routine merges user-controlled JSON keys without validating reserved property names. Merging an attacker payload containing __proto__ modifies the global object prototype shared across the running process.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a JSON payload to any reachable public webhook URL belonging to an n8n workflow. The payload contains prototype-mutating keys whose values target field names later consumed by an action node, such as a record identifier, URL, or recipient. See the GitHub Security Advisory GHSA-2vff-hj5x-8gq7 for technical details.

Detection Methods for CVE-2026-54306

Indicators of Compromise

Inbound webhook payloads containing the literal keys __proto__, constructor, or prototype nested within JSON objects.
Workflow executions in which downstream node inputs contain fields that were never set by the trigger or preceding nodes.
Outbound requests from n8n to hosts not present in the workflow definition or expected destination list.
Unexpected access patterns against records whose identifiers did not originate from the webhook payload.

Detection Strategies

Inspect webhook request bodies at the reverse proxy or web application firewall for reserved JavaScript property names.
Compare workflow execution input objects against the original webhook payload to detect unexpected field injection.
Alert on n8n process making outbound connections to domains outside an allowlist derived from configured credentials.

Monitoring Recommendations

Enable verbose execution logging in n8n and forward logs to a centralized SIEM for correlation.
Track credential usage frequency per workflow and alert on sudden increases tied to public webhook triggers.
Monitor the n8n version banner on instances exposed to the internet to confirm patched releases are deployed.

How to Mitigate CVE-2026-54306

Immediate Actions Required

Upgrade n8n to version 2.25.7 or 2.26.2 or later without delay.
Audit existing workflows that pair a public webhook trigger with action nodes consuming dynamic fields.
Rotate credentials referenced by any workflow that may have processed untrusted webhook traffic before patching.

Patch Information

The maintainers fixed the vulnerability in n8n 2.25.7 and 2.26.2. The patched releases sanitize reserved property names during the internal object-copy operation, blocking prototype pollution from webhook payloads. Refer to the GitHub Security Advisory GHSA-2vff-hj5x-8gq7 for release notes and remediation guidance.

Workarounds

Restrict public webhook exposure by placing n8n behind authenticated reverse proxies or IP allowlists.
Add a preprocessing node that explicitly maps expected fields from $json rather than passing the raw object to downstream nodes.
Filter inbound JSON payloads at the gateway and reject requests containing __proto__, constructor, or prototype keys.

bash

# Example: reject prototype-pollution payloads at an nginx reverse proxy
location /webhook/ {
    if ($request_body ~* "(__proto__|\"constructor\"|\"prototype\")") {
        return 400;
    }
    proxy_pass http://n8n_upstream;
}