CVE-2026-54311: n8n SQL Query Sandbox Pollution – Cross-User Data Leak

Technical summary

The vulnerability stems from improper sandbox isolation in n8n's Merge node SQL Query execution engine. The sandbox context is cached globally and reused across workflow executions rather than being created fresh or properly isolated per-user or per-workflow. When an authenticated user executes a workflow containing a Merge node in SQL Query mode, prototype mutations and modifications to the sandbox object persist in the cached context. Subsequent executions by any user on the instance inherit this polluted state, allowing JavaScript prototype pollution techniques to leak or manipulate data flowing through SQL queries. The issue is rooted in CWE-488 (Exposure of Data Through Debug Information), reflecting the unintended exposure of execution context across trust boundaries.

Business impact

For organizations running multi-user n8n instances, this vulnerability poses a significant confidentiality risk. Any low-privileged user with workflow creation permissions can mount a passive data interception attack against colleagues' workflows without triggering alerts or requiring direct access to their workflows. This is particularly dangerous in environments where n8n coordinates sensitive data flows—such as finance, healthcare, or customer relationship management integrations—where workflow data may contain PII, credentials, or business-critical information. The attack leaves minimal forensic traces and affects all users sharing the instance after the initial pollution, making it difficult to detect or remediate retroactively.

Affected systems

n8n self-hosted and cloud deployments running versions prior to 2.25.7 (if on the 2.25.x branch) or 2.26.2 (if on the 2.26.x or later branches). The vulnerability only manifests in multi-user instances; single-user n8n deployments are unaffected because there is no cross-user data exposure path. Any n8n instance where two or more users have permission to create and execute workflows is at risk if they use the Merge node in SQL Query mode.

Exploitability

Exploitation requires valid n8n credentials and permission to create or modify workflows—conditions commonly met in collaborative automation environments. No user interaction is needed beyond the attacker creating and executing a malicious workflow. The attack is reliable once the sandbox is polluted; subsequent executions by other users will inherit the compromised state automatically. However, the attacker cannot directly exfiltrate data—they must observe side-channel effects or craft subsequent workflows to read polluted state. The barrier to exploitation is low for insiders but requires prior authentication, which CVSS reflects in the PR:L (low privilege required) rating.

Remediation

Upgrade to n8n 2.25.7 or later if running the 2.25.x branch, or to 2.26.2 or later if running 2.26.x and above. The fix implements proper sandbox isolation, likely by creating separate sandbox contexts per execution or invalidating the global cache between user/project boundaries. After patching, review access controls to ensure only trusted users have workflow creation permissions, and consider audit logging of workflow modifications for forensic analysis of potential historical exploitation.

Patch guidance

Apply the latest patch immediately: verify against the vendor advisory for your specific n8n branch version. Users on 2.25.x should update to 2.25.7; users on 2.26.x and later should update to 2.26.2 or the next stable release. Test the upgrade in a non-production environment first, as workflow execution behavior may change. No configuration changes are required post-patch; the fix is transparent to end-users. If you cannot patch immediately, restrict workflow creation permissions to a minimal trusted set of users and disable SQL Query mode in the Merge node until patched.

Detection guidance

Monitor n8n version and audit logs for workflow creation and modification events, particularly by low-privileged accounts. Look for suspicious Merge node SQL Query workflows that attempt prototype pollution or unusual data access patterns. Check for sudden changes in workflow behavior or unexpected data leakage incidents among users on the same instance. Network-based detection is limited because the attack is internal to n8n; focus on application-level logging of sandbox state changes if available. Forensic detection is difficult post-exploitation; prioritize preventive patching and access control.

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 7.7) affecting a popular open-source automation platform widely used in enterprise integrations. The combination of high confidentiality impact, low access barriers for authenticated users, and silent exploitability without user interaction makes it a priority for multi-user instances. Although not yet on CISA's KEV catalog, the vulnerability affects supply-chain-critical infrastructure in some organizations. Patch immediately if your n8n deployment has multiple users with workflow creation rights.

Risk score, explained

CVSS 7.7 (HIGH) reflects: Attack Vector: Network (AV:N) — the instance is reachable over the network; Access Complexity: Low (AC:L) — no special conditions required; Privileges Required: Low (PR:L) — authenticated user required but no admin rights; User Interaction: None (UI:N) — the attack executes automatically; Scope: Changed (S:C) — the pollution affects other users and projects beyond the attacker's immediate context; Confidentiality: High (C:H) — sensitive workflow data is exposed; Integrity: None (I:N) — data is not modified, only read; Availability: None (A:N) — no denial of service. The 'Changed' scope is critical here, elevating severity beyond a simple data leak.

Frequently asked questions