Prototype pollution in n8n - CVE-2026-54306
Published: June 16, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify workflow-driven actions.
The vulnerability exists due to improperly controlled modification of object prototype attributes in public webhook workflow data handling when processing a crafted public webhook payload during internal object copying. A remote attacker can send a specially crafted webhook payload to disclose sensitive information and modify workflow-driven actions.
Exploitation is possible when a workflow combines a public webhook with downstream built-in nodes that consume the resulting fields, which can cause the workflow to act on unintended records or issue outbound requests using the workflow owner's configured credentials.