CVE-2026-54306: n8n Prototype Pollution in Public Webhooks

Technical summary

The vulnerability exploits prototype pollution in n8n's internal object-copying logic during webhook payload processing. When a crafted public webhook payload is received, attacker-controlled fields are injected into the workflow execution context during object assignment or merge operations. These injected fields are then treated as legitimate workflow data and passed downstream to built-in action nodes (e.g., HTTP request nodes, database update nodes, API call nodes). Because the injected fields appear in the normal data flow, nodes that consume this data execute operations using attacker-supplied values rather than legitimate workflow parameters. This becomes a confused-deputy scenario when the workflow has configured credentials or permissions that exceed what the attacker would normally possess. The attack surface is limited to workflows that explicitly use public webhooks and subsequently route that data to action nodes.

Business impact

Organizations running affected n8n versions with public webhook-triggered workflows risk unauthorized data modification, unwanted API calls, and lateral movement through workflow automation pipelines. An attacker with knowledge of a workflow's structure could craft payloads to redirect updates to unintended database records, send requests to unintended third-party systems, or exfiltrate sensitive data by manipulating workflow logic. The blast radius depends on what credentials and data sources are accessible to the affected workflows. For managed n8n Cloud users and self-hosted deployments, this could mean compromised automation chains affecting CRM systems, databases, financial platforms, or other integrated services.

Affected systems

n8n versions prior to 2.25.7 (in the 2.25.x branch) and prior to 2.26.2 (in the 2.26.x branch) are affected. This includes both self-hosted deployments and n8n Cloud instances running unpatched versions. The vulnerability is specific to workflows that accept public webhooks; workflows without public webhook triggers are not affected by this issue.

Exploitability

Exploitability requires knowledge of a target workflow's structure and endpoints. An attacker must identify a public webhook URL and understand which fields the downstream action nodes consume. The attack requires only network access to the webhook endpoint—no authentication is needed—but the effectiveness depends on the target workflow's configuration and the privileges of the workflow owner's credentials. In publicly documented or discovered workflows, or in scenarios where an attacker has partial organizational knowledge, exploitation becomes straightforward. The CVSS score of 6.4 (MEDIUM) reflects the requirement for authenticated workflow setup and the need for specific workflow configurations to be present.

Remediation

Upgrade n8n to version 2.25.7 or later if running the 2.25.x branch, or to version 2.26.2 or later if running the 2.26.x branch. Verify the patched version is deployed across all self-hosted instances and confirm that n8n Cloud instances have received the security update. As an interim measure, restrict public webhook access to known, trusted IP ranges or disable public webhooks on workflows that are not actively required to accept external input.

Patch guidance

Review your n8n deployment to determine which version branch you are running. Users on 2.25.x should upgrade to 2.25.7; users on 2.26.x should upgrade to 2.26.2. Consult the official n8n release notes and security advisory for download links and migration guidance. If you are running a version older than 2.25.x, verify against the vendor advisory whether your specific version is covered by these patches or if additional updates are available. Test the patched version in a staging environment before deploying to production, particularly if you have many active workflows that rely on webhooks.

Detection guidance

Monitor webhook execution logs for unusual payload structures or field names that deviate from expected schemas. Look for webhook invocations that contain nested or unexpected object keys, especially those that might indicate attempts to inject properties like 'constructor' or '__proto__'. Audit workflow execution logs to identify whether unexpected fields were passed downstream to action nodes. Review audit trails for unintended API calls, database modifications, or credential usage that correlate with webhook invocations. Enable verbose logging on public webhooks and action nodes to capture the actual data being processed. If available, implement schema validation on webhook inputs to reject payloads that contain unexpected properties.

Why prioritize this

Although the CVSS score is MEDIUM (6.4), the vulnerability warrants prompt patching because it enables a confused-deputy attack pattern that can manipulate critical business processes. The requirement for a specific workflow configuration (public webhook + action node) limits the affected population, but organizations that do use this pattern face potential unauthorized data modification and lateral movement. The fact that the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list suggests it has not yet been widely weaponized, making this a good window for patching before broader exploitation begins.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: Network-based attack vector (AV:N) requiring no authentication to the webhook; low complexity (AC:L) in crafting a malicious payload; requirement for authenticated workflow setup (PR:L); changed scope (S:C) because injected data can affect downstream systems beyond the workflow's original privilege boundary; low confidentiality and integrity impact (C:L, I:L) constrained by the workflow's actual credential scope; and no availability impact (A:N). The score appropriately penalizes the attack for requiring specific workflow configuration while recognizing the network-accessible attack surface and the potential for lateral movement.

Frequently asked questions