CVE-2026-59206— n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
Possible ATT&CK Techniques 1AI
T1505 · Server Software ComponentGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59206
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
Source: NVD (National Vulnerability Database)
Vulnerability Description
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1321
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59206
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59206
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59206 (1)
- 🔗 Release n8n@2.27.4 · n8n-io/n8n · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-59206 (1)
Vendor Pages for CVE-2026-59206 (1)
- 🔗 Release n8n@2.28.1 · n8n-io/n8n · GitHubx_refsource_MISC
Same Patch Batch · n8n-io · 2026-07-09 · 4 CVEs total
| CVE-2026-59208 | n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution | |
| CVE-2026-59207 | n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector | |
| CVE-2026-59209 | n8n: Shared Credential Header Leak via HTTP Request Pagination Expression |
IV. Related Vulnerabilities
Same product: n8n
- CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject - CVE-2026-59207
n8n: "Allowed HTTP Request Domains" Restriction Bypass via A - CVE-2026-59257
n8n - SQL Injection in MySQL v1 executeQuery Operation via E - CVE-2026-59253
n8n - Improper Authorization in Workflow Assignment to Folde
Same vendor: n8n-io
- CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject - CVE-2026-59207
n8n: "Allowed HTTP Request Domains" Restriction Bypass via A - CVE-2026-44792
n8n: Source Control Pull SQL Injection - CVE-2026-44791
n8n: XML Node Prototype Pollution Patch Bypass
Same weakness: CWE-1321
- CVE-2026-15195
apidevtools json-schema-ref-parser pointer.ts Pointer.set pr - CVE-2026-15187
enquirer Public Package API Enquirer.set prototype pollution - CVE-2026-59876
protobufjs: Text Format string map parsing can mutate return - CVE-2026-54756
Jodit Editor: Prototype pollution via Jodit.configure() / Co - CVE-2026-55886
Jodit Editor: Prototype Pollution in Jodit via Jodit.modules
V. Comments for CVE-2026-59206
No comments yet