Listen to this Post
Introduction
Three critical vulnerabilities have been disclosed in n8n, the popular open-source workflow automation platform, exposing instances to remote code execution (RCE), arbitrary file reads, and prototype pollution attacks. Tracked as CVE-2026-44789, CVE-2026-44790, and CVE-2026-44791, these flaws affect all n8n versions below 1.123.43, 2.20.7, and 2.22.1, and carry maximum CVSS v4 scores. Any organization running n8n for business process automation, data pipelines, or API integrations should treat this as an emergency patching event.
Learning Objectives
- Understand the three critical vulnerabilities in n8n (CVE-2026-44789, CVE-2026-44790, CVE-2026-44791) and their potential impact.
- Learn how to identify, verify, and remediate these vulnerabilities in your n8n deployment.
- Implement temporary workarounds and long-term hardening strategies to secure your workflow automation platform.
You Should Know
- Anatomy of the Attack: Prototype Pollution to RCE (CVE-2026-44789)
This vulnerability targets the HTTP Request node. An authenticated user with permission to create or modify workflows can trigger global prototype pollution via an unvalidated pagination parameter (CWE-1321). By polluting the JavaScript prototype chain and chaining this with other techniques, an attacker can achieve full RCE on the n8n host.
Step‑by‑step guide explaining what this does and how to use it:
This attack chain is sophisticated but can be broken down into these stages:
- Identify Target: An attacker gains authenticated access (e.g., low-privilege user) to a vulnerable n8n instance (version < 1.123.43, 2.20.7, or 2.22.1).
- Craft Payload: The attacker creates or modifies a workflow containing an HTTP Request node.
- Inject Malicious Parameter: In the node’s pagination configuration, they inject a specially crafted parameter.
- Trigger Prototype Pollution: The unvalidated input is processed, polluting the global JavaScript
Object.prototype. - Chain with Another Node: The attacker adds another node (e.g., a “Code” node) that relies on a polluted property. The polluted prototype changes the application’s behavior, allowing the attacker’s payload to be executed.
- Execute Code: The attacker triggers the workflow, leading to arbitrary command execution on the server.
-
Reading Your Secrets: Arbitrary File Read via Git Node (CVE-2026-44790)
This vulnerability resides in the Git node’s “Push” operation. An attacker can inject malicious command-line interface (CLI) flags, forcing the server to read arbitrary files from the local filesystem. This can expose master API tokens, hardcoded secrets, environment files, and configuration data.
Step‑by‑step guide explaining what this does and how to use it:
An attacker could use this flaw to steal your most sensitive data.
Example conceptual command an attacker might inject: git push --upload-pack='sh -c id' origin main
A more practical, step-by-step breakdown of the attack:
- Authenticate: The attacker has permissions to create or modify workflows.
- Add Git Node: A “Git” node is added to a workflow.
- Inject CLI Flags: In the “Push” operation parameters, the attacker appends command injection payloads (e.g.,
; cat /etc/passwd) as additional flags. - Trigger Push: The workflow is executed. The injected flags are passed to the underlying Git command.
- Read Files: The server reads the targeted file (e.g.,
process.env), and the attacker receives the data through workflow outputs. -
Bypassing the Patch: XML Node Prototype Pollution (CVE-2026-44791)
This flaw is a patch bypass for CVE-2026-42232, tied directly to the platform’s XML parsing node. By successfully overriding previous security controls, an attacker can achieve prototype pollution, which, when combined with other node functionalities (like Git or SSH), can be escalated to RCE.
Step‑by‑step guide explaining what this does and how to use it:
This shows how a “fixed” vulnerability can re-emerge.
<!-- Example of a malicious XML payload that could trigger the flaw --> <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY % xxe SYSTEM "file:///etc/passwd"> %xxe; ]> <root>&xxe;</root>
The attack path is as follows:
- Verify Node Existence: The attacker checks if the vulnerable XML node is enabled and accessible.
- Craft XML Payload: A malicious XML payload is crafted to escape the previous patch’s validation.
- Pollute Prototype: The payload causes prototype pollution within the application’s JavaScript runtime.
- Chain with RCE Primitives: The polluted object is used in conjunction with another node (e.g., Git node’s SSH operations) to achieve arbitrary code execution.
- System Compromise: The attacker executes commands, establishing a foothold on the n8n host.
4. Verification: Detecting Vulnerable n8n Instances
You must identify any systems running the affected versions. The vulnerable versions are:
All versions prior to 1.123.43
All versions from 2.0.0-rc.0 up to 2.20.6
All versions from 2.21.0 up to 2.22.0
Step‑by‑step guide for detection:
Use these commands to check your n8n version.
Linux/macOS (Self-Hosted):
Using npm npm list -g n8n Or, if installed locally npm list n8n Using Docker docker exec -it <container_name_or_id> n8n --version
Windows (Self-Hosted):
Using npm npm list -g n8n Or, if installed locally npm list n8n
Web-based Check: Access the n8n web interface and go to your profile settings; the version is often displayed there.
5. Remediation: The Emergency Patch
The only complete solution is to upgrade to a fixed version. The required versions are:
v1.x branch: Upgrade to 1.123.43 or later.
v2.20.x branch: Upgrade to 2.20.7 or later.
v2.21.x/2.22.x branch: Upgrade to 2.22.1 or later.
Step‑by‑step guide for upgrading:
The process depends on your installation method.
Upgrade via npm (Global Installation):
npm update -g n8n
Upgrade via Docker:
docker pull n8nio/n8n:latest docker stop <container_name> docker rm <container_name> Rerun your docker run command with the new image
After the upgrade, restart the n8n service and verify the new version using the commands from the previous section.
- Temporary Mitigation: Workarounds When You Can’t Patch Immediately
If you cannot patch immediately, implement these short-term defensive measures. They are not full solutions but can reduce your immediate risk.
Step‑by‑step guide for implementing workarounds:
Workaround 1: Restrict Permissions
Revoke workflow creation and editing permissions from all non-critical users. Limit these rights strictly to highly trusted platform administrators.
Workaround 2: Disable Vulnerable Nodes
Use the `NODES_EXCLUDE` environment variable to globally disable the problematic nodes.
For CVE-2026-44789: Disable the HTTP Request node.
NODES_EXCLUDE="n8n-nodes-base.httpRequest"
For CVE-2026-44790: Disable the Git and Read/Write Files from Disk nodes.
NODES_EXCLUDE="n8n-nodes-base.git,n8n-nodes-base.readWriteFile"
For CVE-2026-44791: Disable the XML node.
NODES_EXCLUDE="n8n-nodes-base.xml"
To disable multiple nodes:
NODES_EXCLUDE="n8n-nodes-base.httpRequest,n8n-nodes-base.git,n8n-nodes-base.readWriteFile,n8n-nodes-base.xml"
To apply this in Docker:
docker run -e NODES_EXCLUDE="n8n-nodes-base.httpRequest,n8n-nodes-base.git" ...
What Undercode Say:
- “Automation tools are the central nervous system connecting APIs, credentials, and pipelines. A single software compromise opens the floodgates.”
- “Emergency patching is a permanent game of catch-up.”
- “We have to stop defending with static perimeters and make the terrain move faster than the threat.”
Analysis: These insights from Michael Davitt highlight a critical point: while patching is essential, it is inherently reactive. The n8n vulnerabilities demonstrate how a single exploited workflow node can grant an attacker access to your entire credential store and infrastructure. Relying solely on software-layer boundaries for workflow automation is high-risk. True resilience requires a defense-in-depth strategy. This includes network isolation (e.g., running n8n in a dedicated, non-internet-accessible subnet), strict egress filtering, applying the principle of least privilege to workflow creation, and implementing robust secrets management. As Davitt suggests, next-generation concepts like Moving Target Defense—making the attack surface dynamic—could fundamentally change the economics of exploitation, but for now, layered, proactive hardening is the only answer.
Prediction:
The Era of “Workflow Supply Chain” Attacks is Just Beginning
These n8n flaws are a harbinger of a broader trend. As low-code and automation platforms become the central nervous system of corporate IT, they will become the crown jewel targets for sophisticated attackers. Expect to see a rise in “workflow supply chain” attacks where malicious nodes, compromised community templates, or poisoned automation pipelines are used to deploy backdoors, exfiltrate data, and move laterally across networks. Organizations will need to shift from perimeter-based security to a “pipeline-as-code” security model, integrating static analysis, runtime security, and mandatory code reviews for every workflow deployed in production. The speed of automation cannot come at the cost of security validation.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cybersecuritynews Cybersecuritytimes – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
