CVE-2026-59206: n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

The workflow API accepts a crafted workflow, whether saved, updated or imported, and merges attacker-chosen keys into Object.prototype. Once the prototype is polluted, the instance's authentication logic reads attacker-influenced defaults. Requests with no login are then treated as a privileged user.

The attacker first needs an account that can create workflows, which is the default for members. After the pollution, anyone who can reach the instance, with no credentials, can call endpoints such as the user and project listings. The advisory says this discloses every account's email, role and MFA status, and every project on the instance. That is a ready target list for phishing and for finding admin accounts.

The pollution also corrupts global state, so parts of the instance can stop responding until n8n restarts. The vector scores high confidentiality, low integrity and no availability impact, but the advisory names the unresponsiveness.

Because the pollution lives in process memory, it affects all users of the instance, not just the attacker's own workflows.

The n8n npm package in three ranges: before 1.123.61, from 2.0.0-rc.0 before 2.27.4, and 2.28.0 before 2.28.1. Self-hosted instances where users other than fully trusted ones can create workflows are most at risk.

npm ls n8n

For Docker, check the image tag, or read the version in the n8n UI under Settings > About.

Upgrade to n8n 1.123.61, 2.27.4 or 2.28.1, or later, matching your release line.

npm install [email protected]

The advisory gives two temporary mitigations, and says they do not fully remove the risk:

• Restrict workflow creation and editing to fully trusted users.
• Restrict network access to the instance to trusted users.

If you suspect pollution happened, restart the instance to clear the corrupted process state.

Review workflows that were created, updated or imported recently by non-admin users, and look for credential or settings objects holding keys like __proto__, constructor or prototype. Check access logs for unauthenticated requests to the user or project listing endpoints that return HTTP 200. An instance that becomes unresponsive until restart is another sign.

Impact

An authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This can be leveraged to bypass authentication, allowing unauthenticated requests to be treated as a privileged user and exposing endpoints such as the user and project listings. As a result, every account's personal data (email, role, MFA status) and all projects on the instance may be disclosed to unauthenticated callers. The pollution can also corrupt global state, making parts of the instance unresponsive until restarted.

Patches

The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict workflow creation and editing permissions to fully trusted users only.
• Restrict network access to the n8n instance to trusted users only.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.