A prototype pollution vulnerability in n8n occurs when the MCP workflow-validation interpreter evaluates caller-supplied code within the main process. This flaw allows the interpreter to read inherited properties and assign values onto shared prototypes, effectively replacing built‑in methods. An attacker who can only read workflows can exploit this by substituting a built‑in method with one that always returns a truthy value, causing subsequent server‑side permission checks to mistakenly grant scopes the attacker does not hold. The result is full takeover of owner accounts that lack multi‑factor authentication.

The vulnerability exists in n8n before versions 2.41.4 and 2.42.1. The affected vendor is n8n‑io, product n8n. Systems running any of these versions are susceptible.

The CVSS score of 7.7 signals high severity, and the EPSS score is currently unavailable. The flaw is not listed in the CISA KEV catalog. To exploit, an authenticated user with a workflow:read permission can upload or modify a workflow that invokes the MCP workflow-validation tool. Because the interpreter executes code in the main process, the attacker can inject prototype pollution that propagates across the application, bypassing the principal’s permission checks. Successful exploitation allows the attacker to assume the ownership of the account, especially when multi‑factor authentication has not been enabled.