CVE-2026-59206

HIGH

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

Title source: cna
STIX 2.1

Description

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

References (3)

Core 3
Core References

Scores

CVSS v3 7.1
EPSS 0.0030
EPSS Percentile 22.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1321
Status published
Products (8)
n8n/n8n 2.28.0
n8n/n8n < 1.123.61
n8n-io/n8n < 1.123.61
n8n-io/n8n >= 2.0.0-rc.0, < 2.27.4
n8n-io/n8n >= 2.28.0, < 2.28.1
npm/n8n 0 - 1.123.61npm
npm/n8n 2.0.0-rc.0 - 2.27.4npm
npm/n8n 2.28.0 - 2.28.1npm
Published Jul 09, 2026
Tracked Since Jul 09, 2026