CVE-2026-42232Disclosure(n8n / n8n)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch n8n n8n systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

n8n CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r

Weakness type (CWE)

CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
9 mentions across 7 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 9 signals
Disclosure: 7 classified signals
General: 1 classified signal
Peaked 5d ago at 2 mentions (2026-05-04); latest day: 1
9 total mentions across 7 days

Affected systems

Vendors

n8n

Products

n8n

1 version affected across 1 product

Deep dive

Activity timeline9 mentions / 7d

Signal classification3 categories

Disclosure

777.8%

General

111.1%

Patch

111.1%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-27	1	Disclosure1
2026-05-04	2	Disclosure1General1
2026-05-05	2	Disclosure1Patch1
2026-05-18	1	Disclosure1
2026-05-19	1	Disclosure1
2026-05-20	1	Disclosure1
2026-06-08	1	Disclosure1

Full discourse9 posts

Netlas.io@Netlas_io144d
Disclosure
CVE-2026-44789, CVE-2026-44790 & CVE-2026-44791: 3 new vulnerabilities in n8n, 9.4 rating 🔥 Recently disclosed vulnerabilities in n8n allow an attacker to read arbitrary files from the server, achieve global prototype pollution and bypass the patch for previous vulnerability (CVE-2026-42232). 👉 https://nt.ls/dRB5p
Post summary
Three newly disclosed n8n vulnerabilities (CVE‑2026‑44789, 44790, 44791) enable dangerous capabilities such as arbitrary file reading and global prototype pollution, and also allow bypassing of a previous patch.
217055225.7K
7.6K followersView on X
Netlas.io@Netlas_io167d
Disclosure
CVE-2026-42231 and CVE-2026-42232: Two Prototype Pollution vulnerabilities in n8n, 9.4 & 10.0 rating 🔥🔥 Two recently disclosed Prototype Pollution vulnerabilities in n8n allow an authenticated attacker to execute arbitrary code on the server. 👉 https://nt.ls/beZWa
Post summary
Two newly disclosed prototype‑pollution flaws (CVE‑2026‑42231 & CVE‑2026‑42232) in n8n 9.4 & 10.0 grant authenticated users arbitrary code execution on the server, but no exploit, patch, or active use is documented.
060104997
7.6K followersView on X
CCB Alert@CCBalert159d
Patch
Warning: Critical Prototype Pollution in #n8n. #CVE-2026-42231 & #CVE-2026-42232, CVSS: 9.4. An authenticated attacker can exploit the XML parsers and achieve complete remote code execution #RCE! #Patch #Patch #Patch More info: https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-n8n-patch-immediately-0
Post summary
An advisory announces that two critical CVEs in n8n allow authenticated attackers to achieve remote code execution via prototype pollution in XML parsers, and urges users to apply the provided patch.
01011273
7.2K followersView on X
Joey Romaine 🇺🇸 |=★=|@Tank23x0125d
Disclosure
New advisory to triage: CVE-2026-42232. n8n has XML Node Prototype Pollution that to RCE Inventory first. Panic never helps.
Post summary
A new advisory announces CVE-2026-42232, a prototype‑pollution flaw in n8n's XML node that can lead to remote code execution.
2000073
315 followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi145d
Disclosure
📍 CVE-2026-42232 ـ (Prototype Pollution) في XML Node. هذه الثغرة تسمح بـ global prototype pollution عن طريق XML Node. إذا تم دمجها مع Nodes ثانية تستفيد من الخصائص المتآثره، قد تؤدي إلى RCE على سيرفر n8n.
Post summary
The entry explains CVE‑2026‑42232 as a global prototype pollution in XML Node that could lead to remote code execution on n8n servers, with no PoC, exploit, or patch referenced.
10010218
49.3K followersView on X
TodayInCyber@TodayInCyberIO146d
Disclosure
4/5 n8n: five critical vulnerabilities tied to prototype pollution and code execution (CVE-2026-42231, CVE-2026-42232, CVE-2026-44789, CVE-2026-44790, CVE-2026-44791).
Post summary
The post announces five new n8n vulnerabilities tied to prototype pollution and code execution, but it offers no PoC, exploit details, or mitigation guidance.
100104
8 followersView on X
CVE@CVEnew160d
General
CVE-2026-42232 n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflow… https://www.cve.org/CVERecord?id=CVE-2026-42232
Post summary
The post identifies CVE-2026-42232 affecting specific n8n versions, noting that authenticated users with workflow permissions can alter workflows, but provides no PoC, patch, or exploitation evidence.
00010172
57.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds160d
Disclosure
CVE-2026-42232 Authenticated Prototype Pollution Leading to RCE in n8n Workflow Automation Platform https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42232
Post summary
The post references the disclosure of CVE-2026-42232, noting an authenticated prototype pollution flaw in n8n that leads to remote code execution, but provides no payload, exploitation, or remediation details.
0000044
4.0K followersView on X
Infoflowcloud@infoflowcloud160d
Disclosure
🚨*CVE* CVE-2026-42232 n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflow… https://www.cve.org/CVERecord?id=CVE-2026-42232 ----- Traducción: CVE-2026-42232 n8n… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-42232 affecting n8n, providing basic details about affected versions and the vulnerability scope, but does not include a PoC, exploit code, or patch information.
0000029
75 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	n8n	n8n	-	node.js	-
App	n8n	n8n	2.18.0	node.js	-

Explore more

Back to dashboard n8n CVEs n8n vulnerabilities

What researchers are saying

CVE-2026-42232

Netlas.io[verified]@Netlas_ioDisclosure

Three newly disclosed n8n vulnerabilities (CVE‑2026‑44789, 44790, 44791) enable dangerous capabilities such as arbitrary file reading and global prototype pollution, and also allow bypassing of a previous patch.

Netlas.io[verified]@Netlas_ioDisclosure

Two newly disclosed prototype‑pollution flaws (CVE‑2026‑42231 & CVE‑2026‑42232) in n8n 9.4 & 10.0 grant authenticated users arbitrary code execution on the server, but no exploit, patch, or active use is documented.

Joey Romaine 🇺🇸 |=★=|[verified]@Tank23x0Disclosure

A new advisory announces CVE-2026-42232, a prototype‑pollution flaw in n8n's XML node that can lead to remote code execution.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

The entry explains CVE‑2026‑42232 as a global prototype pollution in XML Node that could lead to remote code execution on n8n servers, with no PoC, exploit, or patch referenced.

TodayInCyber[verified]@TodayInCyberIODisclosure

The post announces five new n8n vulnerabilities tied to prototype pollution and code execution, but it offers no PoC, exploit details, or mitigation guidance.

CCB Alert@CCBalertPatch

An advisory announces that two critical CVEs in n8n allow authenticated attackers to achieve remote code execution via prototype pollution in XML parsers, and urges users to apply the provided patch.

CVE@CVEnewGeneral

The post identifies CVE-2026-42232 affecting specific n8n versions, noting that authenticated users with workflow permissions can alter workflows, but provides no PoC, patch, or exploitation evidence.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post references the disclosure of CVE-2026-42232, noting an authenticated prototype pollution flaw in n8n that leads to remote code execution, but provides no payload, exploitation, or remediation details.