CVE-2026-86078: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

The Instance AI module builds a structural summary of a stored workflow. It does this with get-or-create-then-nested-write code keyed by node names and connection keys. Those keys are arbitrary strings. With __proto__ as the key, the lookup resolves up the prototype chain instead of creating an own key, so the nested write modifies Object.prototype in the main n8n process.

The editor blocks reserved names, but that check runs in the browser. Posting the workflow to the REST API directly skips it. The attacker needs a low-privilege account that can save workflows, and the Instance AI module must reach this path.

Because Object.prototype is shared, the damage persists and affects every later request until the process restarts. The CVSS vector rates availability impact as high and confidentiality and integrity as none. On a shared n8n instance, one user can break automation for all others.

The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain.

Affected: n8n from 2.38.0 up to but not including 2.38.2, and every release below 2.37.7. The vulnerable code runs when the Instance AI module is configured, which the advisory ties to the N8N_INSTANCE_AI_MODEL* environment variables. Check the version:

npm ls n8n

For Docker installs, check the image tag or the version in the n8n UI.

Upgrade to 2.37.7 or 2.38.2, or later:

npm install -g [email protected]

The advisory lists stopgaps that it says do not fully remediate the risk:

• Limit instance access to fully trusted users.
• Remove, or leave unset, the N8N_INSTANCE_AI_MODEL* variables so the Instance AI module does not reach the vulnerable path.
• Restart the n8n process to clear in-memory pollution if you suspect an attack.

Search stored workflows and REST API request bodies for node names or connection keys equal to __proto__, constructor or prototype. Watch for sudden, widespread errors or failing requests in n8n that begin after a workflow save, and for unexplained behaviour that clears after a restart. The advisory describes a restart as the way to clear the pollution and lists no other indicators.

Impact

The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the workflow to the REST API directly. So a reserved key such as __proto__ resolved up the prototype chain instead of creating an own key, and the write landed on Object.prototype in the main n8n process, affecting every later request. The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain.

Patches

The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Remove or leave unconfigured the N8N_INSTANCE_AI_MODEL* environment variables to prevent the Instance AI module from reaching the vulnerable code path.
• Restart the n8n process to clear any in-memory prototype pollution if an attack is suspected.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.