PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54306 n8n-io CVE debrief

CVE-2026-54306 is a medium-severity vulnerability in n8n, an open-source workflow automation platform. A prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2. Users should update to a patched version to prevent exploitation.

Vendor
n8n-io
Product
n8n
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-26
Advisory published
2026-06-23
Advisory updated
2026-06-26

Who should care

Users of n8n workflow automation platform, especially those using public webhooks with action nodes that consume resulting fields, should be aware of this vulnerability. Security teams and administrators responsible for n8n deployments should prioritize patching to prevent potential exploitation.

Technical summary

The vulnerability exists in n8n versions prior to 2.25.7 and 2.26.2. A crafted public webhook payload can inject attacker-controlled fields into workflow data during internal object copying. These fields can be consumed by downstream built-in nodes, potentially allowing an attacker to target unintended records or issue outbound requests using the workflow owner's credentials. The vulnerability has a CVSS score of 6.3 and is classified as medium severity.

Defensive priority

Patching to versions 2.25.7 or 2.26.2 is recommended to address this vulnerability. In the interim, defenders should monitor workflow activity for suspicious behavior and restrict access to public webhooks where possible.

Recommended defensive actions

  • Update n8n to version 2.25.7 or 2.26.2
  • Monitor workflow activity for suspicious behavior
  • Restrict access to public webhooks
  • Review workflows for combinations of public webhooks with action nodes
  • Implement additional logging and monitoring for affected systems

Evidence notes

The vulnerability was reported and fixed by the n8n team. Details were published in a GitHub security advisory (GHSA-2vff-hj5x-8gq7). The CVE record and NVD details provide additional context on the vulnerability.

Official resources

This article is AI-assisted and based on the supplied source corpus.