Attack Chain

1. An authenticated user logs into the n8n instance.
2. The user creates or modifies an existing workflow.
3. Within the workflow, the user adds an HTTP Request node.
4. The user configures the HTTP Request node to use pagination.
5. The user injects a malicious payload into the pagination parameter, exploiting the prototype pollution vulnerability.
6. The injected payload pollutes the global prototype.
7. The attacker leverages the prototype pollution to achieve code execution, potentially by overwriting critical functions or properties.
8. The attacker executes arbitrary commands on the n8n instance, potentially leading to complete system compromise.

Impact

Successful exploitation of this vulnerability, tracked as CVE-2026-44789, allows an attacker to execute arbitrary code on the n8n instance. This could lead to complete system compromise, data theft, or denial of service. The severity is rated as critical due to the potential for RCE and the relatively low skill required to exploit the vulnerability. Organizations using vulnerable versions of n8n are at significant risk.

Recommendation

• Upgrade n8n to version 1.123.43, 2.20.7, 2.22.1, or later to patch CVE-2026-44789 (see Patches section).
• Limit workflow creation and editing permissions to only fully trusted users as a short-term mitigation (see Workarounds section).
• Disable the HTTP Request node by adding n8n-nodes-base.httpRequest to the NODES_EXCLUDE environment variable as another temporary mitigation (see Workarounds section).