CVE Intelligence
Analysis AI-assisted

CVE-2026-44791: n8n Workflow Platform: XML Node Patch Bypass Enabling Possible RCE

CVE-2026-44791 affects the n8n workflow automation platform in the version ranges listed in the record, which are fixed in 1.123.43, 2.22.1 and 2.20.7. According to the record, an authenticated user allowed to create or modify workflows could bypass the earlier fix for CVE-2026-42232 in the XML node, and combined with other nodes this could lead to remote code execution on the n8n host. The record rates it critical with an NVD CVSS 3.1 score of 9.9, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

n8n is an open source workflow automation platform. According to the record, an authenticated user with permission to create or modify workflows could bypass the earlier patch for CVE-2026-42232 in the XML node. The record associates the issue with CWE-1321 (Prototype Pollution). The vendor advisory is the main source consulted, as linked in the GitHub Security Advisory.

Impact

  • The record states that, when combined with other nodes, the bypass could lead to remote code execution (RCE) on the n8n host.
  • NVD scores it CVSS 3.1 9.9 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). GitHub lists a CVSS 4.0 score of 9.4.
  • The CVSS 3.1 vector includes a changed scope (S:C). This suggests, as an inference, that impact may reach beyond the vulnerable component.

Affected products and versions

  • Product listed in the record: n8n (recorded as N8n N8n).
  • Ranges listed as affected: below 1.123.43; from 2.0.0 up to but not including 2.20.7; from 2.21.0 up to but not including 2.22.1.
  • Fixed versions named in the record: 1.123.43, 2.22.1 and 2.20.7.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Update n8n to a fixed version in your release line: 1.123.43, 2.22.1 or 2.20.7.
  • Limit workflow creation and modification permissions to users who truly need them, applying least privilege.
  • Review existing workflows that combine the XML node with other nodes, and check for unexpected changes.
  • The record classifies the fix type as mitigation. Consult the vendor advisory for complete guidance.

Detection guidance

  • Audit workflow create and modify events, especially those performed by lower-privileged accounts.
  • Review recently changed workflows that include XML nodes.
  • Monitor the n8n host for unexpected child processes or outbound connections originating from the n8n service account.
  • Centralize n8n logs so that investigations can be reconstructed.

Limitations of the available information

  • The record does not describe the technical mechanism of the bypass or which node combinations are involved. This analysis does not provide them.
  • The record does not explain how CWE-1321 relates to the described behavior.
  • No EPSS or SSVC data is available in the record.
  • Whether attempted exploitation has been observed is not documented in the sources consulted.

Frequently asked questions

Is CVE-2026-44791 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which n8n versions are fixed?

According to the record, the fixed versions are 1.123.43, 2.22.1 and 2.20.7, depending on your release line.

Who needs to be concerned about this issue?

Organizations running affected n8n ranges, especially where many users can create or modify workflows that use the XML node.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.