n8n Prototype Pollution via Public Webhook Payload
A prototype pollution vulnerability in n8n allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying.
What changed
A prototype pollution vulnerability in n8n allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed by downstream built-in nodes, potentially enabling a confused deputy attack.
Who it affects
Users running n8n versions prior to 2.25.7 or 2.26.2 who have workflows combining public webhooks with action nodes that consume incoming fields, especially those using sensitive credentials or database operations.
What to do today
Upgrade n8n to version 2.25.7, 2.26.2, or later. If immediate upgrade is not possible, avoid exposing public webhook workflows that pass data through transform nodes into action nodes with sensitive credentials or database operations, and limit workflow creation and editing permissions to trusted users.