CVE-2026-118678

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description Low-privileged users can alter built-in object behavior by saving workflows with specially named connection keys. By adding keys such as proto to workflow connections, the periodic history compaction task processes these keys, leading to server errors that cause logins and writes to fail. This is a prototype pollution issue, where an attacker manipulates the prototype of a base object to change the behavior of all objects inheriting from it.

Recommendations Update n8n to version 2.41.4 or later. Update n8n to version 2.42.1 or later.