Live › vulnerability › CVE-2026-118678
Go to dashboardn8n before 2.41.4 and 2.42.x before 2.42.1 lets a low-privileged user save a workflow with keys such as __proto__ in its connections. The periodic history compaction task processes those keys and alters built-in object behaviour, so logins and writes fail with server errors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted n8n instances that let low-privileged users create or save workflows are exposed, because those users can plant the malicious connection keys. Instances where only trusted administrators can edit workflows face less risk. Managed n8n hosting is handled by the vendor. Sources do not say whether the impact is limited to the server-error denial of service described or extends beyond it.
No product ranges from the sources yet.
n8n --version (or check the image tag) and compare against 2.41.4 and 2.42.1__proto__ key2.41.4 on the 2.41 line, or to 2.42.1 on the 2.42 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as proto to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.
This page as .md · .json · in your agent: get_signal("CVE-2026-118678")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.