CVE-2026-54306

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description A prototype pollution issue allows a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially altering the behavior of the application. These injected fields can be consumed as normal values by downstream built-in nodes. In workflows combining a public webhook with action nodes, this can lead to a confused deputy scenario, where the workflow targets unintended records or issues outbound requests using the workflow owner's configured credentials.

Recommendations Update to version 2.25.7 or later. Update to version 2.26.2 or later. Avoid exposing public unauthenticated webhook workflows that pass incoming data through transform nodes into action nodes with sensitive credentials or database operations. Limit workflow creation and editing permissions to fully trusted users only.