n8nPublished 28 Oct 2026NVD status: Deferred

CVE-2026-118649

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match…

Componentn8n
Severityhigh (CVSS 8.3)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Published (NVD)2026-10-28
Last modified2026-10-29
Affected versions
< 2.43.5
>= 2.44.0, < 2.44.1
from the CVE Program record written by the CNA that assigned the CVE
Fixed in2.43.5, 2.44.1
WeaknessCWE-1321
CISA KEVnot listed

Versions, checked against NVD

NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above come from the CVE record written by VulnCheck, the CNA that assigned the CVE.

NVD description

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

What to do

  • Upgrade n8n to the fixed release of the branch you run: 2.43.5 or 2.44.1, or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more