CVE-2026-59206 Details

A prototype pollution vulnerability has been identified in n8n, an open-source workflow automation platform. This issue affects versions prior to 1.123.61, 2.27.4, and 2.28.1. The vulnerability allows an authenticated user with the default 'workflow:create' permission to manipulate the Object.prototype by saving, updating, or importing a crafted workflow via the workflow API. This manipulation can bypass authentication, treating unauthenticated requests as privileged and exposing user and project listing endpoints. Consequently, personal data such as email, role, and multi-factor authentication status, along with all projects on the instance, may be disclosed to unauthenticated users. Additionally, the pollution can disrupt the global state of the application, causing parts of the instance to become unresponsive until a restart is performed.

Users can upgrade to n8n versions 1.123.61, 2.27.4, or 2.28.1 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to restrict workflow creation and editing permissions to trusted users and limit network access to the n8n instance to trusted users only.