CVE-2026-59206: n8n 2.28.0

Affected technology

n8n · before 1.123.61 (exclusive)
n8n

n8n · from 2.0.0 (inclusive), before 2.27.4 (exclusive)
n8n

n8n · 2.28.0
n8n

n8n · >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4, < 1.123.61
n8n-io

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.