CVE-2026-110842

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description A prototype pollution issue exists in the MCP workflow-validation tool. The interpreter evaluates caller-supplied code in the main process, reads inherited properties, and allows assignment to shared prototypes. An authenticated user with workflow:read permissions can replace a built-in method to return a truthy value, causing server-side permission checks to accept unauthorized scopes. This can lead to the takeover of owner accounts that do not have multi-factor authentication (MFA) enabled.

Recommendations Update n8n to version 2.41.4 or later. Update n8n to version 2.42.1 or later.