Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

n8n lets signed‑in users hijack accounts

CVE-2026-110842 · published 1 day ago
Summary

The n8n automation tool lets a user who can only view workflows change internal code and trick the system into thinking they have higher permissions. This can let them take over accounts that do not use multi‑factor authentication. Upgrade n8n to the latest version or apply the vendor’s patch as soon as possible.

What to do
  • Update n8n-io n8n to version 2.41.4 or later.
Affected software
VendorProductAffected versions
n8n-io n8n < 2.41.4
Original advisory text
n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110842 · NVD
CVE-2026-110842 · MITRE
CVE-2026-110842 · OSV
GHSA-5jr4-xmvf-frmj · GHSA
Track software like this
Free during beta