CVE-2026-86078 Overview
CVE-2026-86078 is a prototype pollution vulnerability [CWE-1321] in n8n, an open source workflow automation platform. Versions prior to 2.37.7 and 2.38.2 are affected. The Instance AI workflow summary feature treats node names and connection keys from stored workflows as ordinary object keys. An authenticated user can submit a workflow through the REST API containing __proto__ or constructor keys. Nested writes then reach Object.prototype in the main n8n process and disrupt later requests. The vulnerable logic resides in the summarizeWorkflowStructure function in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts.
Critical Impact
Authenticated attackers can pollute Object.prototype in the main n8n process, disrupting subsequent requests and causing denial of service across the workflow automation instance.
Affected Products
- n8n workflow automation platform versions prior to 2.37.7
- n8n workflow automation platform versions prior to 2.38.2
- The @n8n/instance-ai package containing the summarizeWorkflowStructure function
Discovery Timeline
- 2026-09-08 - CVE-2026-86078 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86078
Vulnerability Analysis
The vulnerability exists in the Instance AI workflow summary feature of n8n. The summarizeWorkflowStructure function iterates over user-controlled node names and connection keys from stored workflows. These keys are used directly as property names during nested object assignment. JavaScript treats __proto__ and constructor as special property accessors that traverse the prototype chain. Writes to these keys mutate Object.prototype instead of the intended container object. Because the main n8n process is long-running, polluted properties persist across requests. Subsequent operations that rely on default object shapes behave unpredictably or fail entirely.
Root Cause
The root cause is improper handling of dynamically controlled object keys, tracked as [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes). The summarizeWorkflowStructure implementation lacks key sanitization or the use of null-prototype objects (Object.create(null)) when building its internal summary structure. Any workflow definition accepted through the REST API can inject prototype-modifying keys.
Attack Vector
Exploitation requires network access to the n8n REST API and a low-privileged authenticated account permitted to submit workflows. An attacker crafts a workflow whose node names or connection keys include __proto__ or constructor with nested values. When the Instance AI summary feature processes the workflow, the crafted keys reach Object.prototype. Legitimate requests handled afterward inherit the polluted properties, disrupting availability of the automation platform. The attack does not require user interaction and does not affect confidentiality or integrity, but it produces a high availability impact against the shared process.
See the GitHub Security Advisory GHSA-679f-58pq-4v2c for authoritative technical details.
Detection Methods for CVE-2026-86078
Indicators of Compromise
- Workflow definitions in n8n storage or REST API request bodies containing node names or connection keys equal to __proto__, constructor, or prototype.
- Unexpected errors or altered default values in workflow executions immediately following invocation of the Instance AI workflow summary feature.
- Restarts or crashes of the main n8n process correlated with recent workflow submissions from a specific user or API token.
Detection Strategies
- Inspect n8n REST API request payloads for JSON keys matching __proto__ or constructor in workflow node or connection structures.
- Review audit logs for workflow create or update operations authored by low-privileged users prior to service instability.
- Compare installed n8n version against the fixed releases 2.37.7 and 2.38.2 to identify vulnerable deployments.
Monitoring Recommendations
- Enable request logging on the API gateway or reverse proxy fronting n8n and alert on payloads containing prototype-manipulation tokens.
- Monitor process health and error rates for the n8n main process, correlating anomalies with recent workflow modifications.
- Track invocations of Instance AI features by user identity to establish a baseline for anomalous submissions.
How to Mitigate CVE-2026-86078
Immediate Actions Required
- Upgrade n8n to version 2.37.7 or 2.38.2 or later without delay.
- Audit existing stored workflows for node names or connection keys containing __proto__ or constructor and remove them.
- Restrict REST API access to trusted users and rotate API credentials that may have been used to test the flaw.
Patch Information
The issue is fixed in n8n 2.37.7 and 2.38.2. Both releases update summarizeWorkflowStructure to prevent user-controlled keys from reaching Object.prototype. Review the GitHub Security Advisory GHSA-679f-58pq-4v2c for release notes and upgrade guidance.
Workarounds
- Disable the Instance AI workflow summary feature until the patched version is deployed.
- Place a validating reverse proxy or API gateway in front of n8n that rejects JSON payloads containing __proto__, constructor, or prototype as object keys.
- Limit workflow creation and modification privileges to a minimal set of trusted operators.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
