CVE-2026-72749: n8n before 1.123.67 Prototype Pollution via Edit Fields
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.67 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.31.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.32.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72749?
CVE-2026-72749 has a risk score of 53, indicating a moderate level of severity.
What is CVE-2026-72749 about?
CVE-2026-72749 describes a prototype pollution vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1.
How do I fix CVE-2026-72749?
To fix CVE-2026-72749, upgrade n8n to version 1.123.67 or a later version.
Which versions of n8n are affected by CVE-2026-72749?
CVE-2026-72749 affects n8n versions before 1.123.67, 2.31.5, and 2.32.1.
Who can exploit CVE-2026-72749?
CVE-2026-72749 can be exploited by authenticated users who can manipulate field names in the Edit Fields node.