{"id":"EUVD-2026-38474","enisaUuid":"5d589030-b2b6-366c-8ee9-7dcf20552298","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner\u0027s configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:43:12 PM","dateUpdated":"Jun 26, 2026, 7:29:51 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7\n","aliases":"CVE-2026-54306\nGHSA-2vff-hj5x-8gq7\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"4c6dc223-b59b-3909-98e3-30221b80c2f5","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"},{"id":"84158c32-6f7f-3acd-8399-c56a5919f4de","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"}],"enisaIdVendor":[{"id":"283aed66-8e92-3d1b-a566-aea4457c955a","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"677ad958-6617-3d18-8c30-97124abecf82","vulnerability":{"id":"GHSA-2vff-hj5x-8gq7","description":"n8n: Prototype Pollution enables confused-deputy execution via public webhooks","datePublished":"Jun 16, 2026, 7:00:41 PM","dateUpdated":"Jul 20, 2026, 1:45:14 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54306\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38474\n","aliases":"CVE-2026-54306\nGHSA-2vff-hj5x-8gq7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"92939d9e-dd35-32bf-b3f0-ca126d8029f2","vulnerability":{"id":"CVE-2026-54306","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner\u0027s configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.","datePublished":"Jun 23, 2026, 3:43:12 PM","dateUpdated":"Jun 26, 2026, 7:29:51 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7\n","enisa_id":"EUVD-2026-38474\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 1, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"61295c2a-610b-30c4-a3ce-36221963ef43","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"},{"id":"8c916d7e-2cd1-3eae-bfef-92e9f868fa4e","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.25.7"}],"vulnerabilityVendor":[{"id":"d261d90e-009f-3c23-9985-ef075a1609a7","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[{"id":"227478d4-a44b-3acc-8ee2-9a85f1b55d26","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}