CVE-2026-54311 Details
Description
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL executions belonging to other users or projects. This allowed a low-privileged attacker to intercept workflow data processed by other users on the same instance. This issue only affects multi-user n8n instances where more than one user has permission to create and execute workflows containing the Merge node in SQL Query mode. This vulnerability is fixed in 2.25.7 and 2.26.2.
A prototype pollution vulnerability has been identified in n8n, an open-source workflow automation platform, affecting versions prior to 2.25.7 and 2.26.2. The issue arises in multi-user instances where authenticated users can create or modify workflows. These users could manipulate the sandbox environment of the Merge node's SQL Query mode, introducing prototype mutations that persist across different users' workflow executions. This flaw enabled low-privileged attackers to intercept workflow data from other users on the same instance.
Users should upgrade to n8n version 2.25.7 or 2.26.2 or later. If an immediate upgrade is not possible, consider limiting workflow permissions to trusted users and disabling the Merge node by adding 'n8n-nodes-base.merge' to the 'NODES_EXCLUDE' environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-488 | Exposure of Data Element to Wrong Session | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 2.25.7 >= 2.26.0, < 2.26.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |