CVE-2026-72769 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, especially those with authenticated users who can create or edit workflow expressions, should assess exposure and potential impact. They should prioritize verifying instance vulnerability, implementing compensating controls, and monitoring for suspicious activity.

Why it matters

CVE-2026-72769 is a prototype pollution vulnerability in n8n's VM expression engine that can lead to denial of service. Defenders should prioritize verifying exposure, assessing impact, and implementing compensating controls.

• Denial of service via prototype pollution
• Potential disruption to workflow execution
• Need for compensating controls and monitoring
• Verification of instance exposure and vulnerability

Technical summary

The n8n VM expression engine is vulnerable to prototype pollution. An authenticated user can create or edit a workflow expression to obtain a reference to a host built-in and pollute its prototype, leading to a denial of service. Affected versions include n8n before 1.123.67, 2.31.5, and 2.32.1. The vulnerability can be exploited by manipulating the prototype of a host built-in, potentially disrupting workflow execution and requiring compensating controls and monitoring. Defenders should prioritize verifying exposure, assessing impact, and implementing mitigations.

Defensive priority

Defenders should prioritize verifying exposure in n8n instances, especially those with authenticated users who can create or edit workflow expressions. They should also assess the impact of a potential denial of service and implement compensating controls.

Recommended defensive actions

• Verify n8n instance exposure, especially for authenticated users who can create or edit workflow expressions
• Assess potential denial of service impact and implement compensating controls
• Monitor for suspicious workflow expression activity
• Apply vendor-provided patches or updates when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and references to vendor advisories. However, the corpus does not establish exploitation or impact beyond denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.