CRITICAL🇵🇱 Wersja polska

CVE-2026-44789

CVSS 9.4v4.0pub. 2026-06-23upd. 2026-06-24

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability classified as CWE-1321 (prototype pollution) results from lack of validation of the pagination parameter passed to the HTTP Request node. An authenticated user with permissions to create or modify workflows can inject properties into the prototype of the global JavaScript object. The prototype pollution can then be exploited in combination with other techniques to achieve RCE on the n8n instance.

Impact

An attacker can gain full control over an n8n instance through remote code execution (RCE), threatening the confidentiality, integrity, and availability of both the instance itself and systems integrated with it.

Mitigation & patch

Update n8n to version 1.123.43, 2.22.1, or 2.20.7, in which the vulnerability has been fixed. Details available in the vendor references: https://github.com/n8n-io/n8n/security/advisories/GHSA-c8xv-5998-g76h

Who is affected

n8n in versions prior to 1.123.43, 2.22.1, and 2.20.7

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X