CVE-2026-44789: n8n Prototype Pollution via HTTP Request Node Pagination Parameter
CVE-2026-44789 affects n8n, an open source workflow automation platform, and is classified as prototype pollution (CWE-1321). According to the record, an authenticated user who can create or modify workflows could abuse an unvalidated pagination parameter in the HTTP Request node to pollute global objects, which combined with other techniques could lead to remote code execution. Fixed versions are 1.123.43, 2.20.7 and 2.22.1, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-44789 is a prototype pollution weakness (CWE-1321) in n8n, an open source workflow automation platform. The record states that the issue stems from an unvalidated pagination parameter in the HTTP Request node. The vendor advisory is the main source consulted for this analysis: GitHub Security Advisory GHSA-c8xv-5998-g76h.
Impact
According to the record, an authenticated user with permission to create or modify workflows could achieve global prototype pollution. The description adds that, combined with other techniques, this could lead to remote code execution on the instance.
- Confidentiality, integrity and availability: NVD scores the CVSS v3.1 base at 9.9 with high impact on all three properties, and the CNA (GitHub) provides a CVSS v4.0 score of 9.4.
- Scope: the vector used in the NVD score indicates a changed scope, which means impact can extend beyond the vulnerable component.
Affected products and versions
The record lists the product as n8n and the following ranges:
- Versions before 1.123.43.
- Versions from 2.0.0 up to, but not including, 2.20.7.
- Versions from 2.21.0 up to, but not including, 2.22.1.
The record does not provide further detail on configurations or deployment types beyond these ranges.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. This analysis does not rely on any claim of active exploitation.
Remediation and mitigation
- Upgrade n8n to 1.123.43, 2.20.7 or 2.22.1, depending on the release line in use. The record states these versions contain the fix.
- Review which accounts have permission to create or modify workflows and restrict that permission to users who need it.
- Monitor the vendor advisory for updates on any additional mitigation guidance.
Detection guidance
- Review audit and activity logs for unusual workflow creation or modification by low-privilege or recently created accounts.
- Inspect HTTP Request node configurations in workflows for unexpected or malformed pagination settings, and treat unexpected changes as a signal for investigation.
- Watch for unexpected behavior of the n8n process after workflow executions, such as configuration changes or unexpected outbound activity, as general indicators of compromise.
Limitations of the available information
- The record does not describe the exact technical mechanism, so this analysis does not include it.
- The record does not confirm whether public proof of concept code exists.
- The record does not state whether the mitigation link in the references is a complete workaround or only partial guidance; consult the vendor advisory for details.
- EPSS and SSVC data are not available in the record, so exploitation likelihood is unknown.
Frequently asked questions
Which n8n versions fix CVE-2026-44789?
According to the record, the fixed versions are 1.123.43, 2.20.7 and 2.22.1, depending on the release line in use. Upgrading to the fixed version of your line is the recommended action.
Is this CVE being actively exploited?
The record shows no CISA KEV listing for this CVE, and no confirmed exploitation appears in the sources consulted. Organizations should still prioritize patching given the critical score.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.