---
id: "CVE-2026-118678"
kind: "vulnerability"
aliases: ["CVE-2026-118678"]
title: "n8n: prototype pollution via workflow connection keys breaks logins and writes"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "n8n", "self-hosted", "workflow-automation"]
not_affected_if: ["admin-only-workflow-editing", "managed-hosting"]
published_at: "2026-10-28T19:17:33+00:00"
first_seen_at: "2026-10-28T19:34:55+00:00"
updated_at: "2026-10-28T19:36:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118678", "first_seen_at": "2026-10-28T19:34:55+00:00"}]
---

# n8n: prototype pollution via workflow connection keys breaks logins and writes

n8n before 2.41.4 and 2.42.x before 2.42.1 lets a low-privileged user save a workflow with keys such as __proto__ in its connections. The periodic history compaction task processes those keys and alters built-in object behaviour, so logins and writes fail with server errors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `n8n --version` (or check the image tag) and compare against `2.41.4` and `2.42.1`
- Look for workflows whose connections object contains a `__proto__` key
- unknown

## Fix

- Upgrade n8n to `2.41.4` on the 2.41 line, or to `2.42.1` on the 2.42 line
- unknown

## Timeline

- 2026-10-28T19:34:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118678

## From the sources

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_