AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-c8xv-5998-g76h: n8n: HTTP Request Node Pagination Prototype Pollution to RCE

criticalvulnerability

security

Source: GitHub Advisory DatabaseMay 14, 2026CVE-2026-44789

Summary

An authenticated user in n8n (a workflow automation tool) could exploit an unvalidated pagination parameter in the HTTP Request node to achieve prototype pollution (a type of attack that corrupts an object used by many parts of a program), potentially leading to RCE (remote code execution, where an attacker can run commands on a system they don't control). This vulnerability requires the attacker to have permission to create or modify workflows.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily: (1) limit workflow creation and editing permissions to fully trusted users only, or (2) disable the HTTP Request node by adding `n8n-nodes-base.httpRequest` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.