CVE-2026-44789

n8n: HTTP Request Node Pagination Prototype Pollution to RCE

View on CVE.org
Published Jun 23, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

Analysis

AI-generated

Technical impact

n8n is an open source workflow automation platform. An authenticated user with permission to create or modify workflows can achieve global prototype pollution through an unvalidated pagination parameter in the HTTP Request node. This flaw exists in versions prior to 1.123.43, 2.22.1, and 2.20.7. When combined with other techniques, it can lead to remote code execution on the instance. The vulnerability is classified under CWE‑1321 and is fixed in the specified releases.

Affected Systems

The affected product is n8n from n8n‑io. Versions prior to 1.123.43, 2.22.1, and 2.20.7 are vulnerable. Users running any of these releases without the patch are at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.4, indicating a critical impact. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. The attack requires an authenticated account with permission to create or modify workflows and can be achieved locally within the instance; no remote exploitation without credentials is documented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade n8n to version 1.123.43, 2.22.1, or 2.20.7, whichever applies to your deployment, to apply the patch that removes the prototype pollution vulnerability.
  • Restrict workflow creation and modification privileges to trusted users only, and audit workflow changes for unusual activity.
  • Enforce that the pagination parameter of the HTTP Request node accepts only valid numeric values within a reasonable range and block requests with non‑numeric or out‑of‑range values pending the upgrade.

Generated by OpenCVE AI on June 24, 2026 at 11:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-c8xv-5998-g76h n8n: HTTP Request Node Pagination Prototype Pollution to RCE
History
Type Values Removed Values Added
First Time appeared N8n
N8n n8n
Vendors & Products N8n
N8n n8n
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.
Title n8n: HTTP Request Node Pagination Prototype Pollution to RCE
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}
Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jun 24, 2026, 2:02 PM
Reserved
May 7, 2026, 7:20 PM

View source JSON

Updated
Jun 24, 2026, 2:01 PM

JSON

Status
Analyzed
Published
Jun 23, 2026, 5:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

No data.

Updated
Jun 24, 2026, 4:00 PM

JSON