All vulnerabilities
GHSA-5jr4-xmvf-frmj

n8n: Shared Prototype Mutation Through the MCP Workflow-Validation Interpreter Allows Owner Account Takeover

n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published30 Sep 2026Updated 30 Sep 2026GitHub

What fixes it

No source in this snapshot names a fixed version.

Description

Impact

The MCP workflow-validation tool evaluates caller-supplied code in the main process through an interpreter that reads inherited properties and allows assignment onto shared prototypes. A member holding only a read grant can replace a built-in method with one that returns a truthy value, which makes a server-side permission check accept a scope they do not hold. The reporter drove this to a full takeover of the instance owner's account. Accounts protected by MFA are not affected.

Patches

The issue has been fixed in n8n versions 2.41.4 and 2.42.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Disable the instance-level MCP server if it is not required.
  • Restrict n8n instance access to fully trusted users only.
  • Enable MFA on all owner and admin accounts to prevent password-reset links from being usable even if obtained.
  • Audit and revoke workflow:read MCP OAuth grants from any users who do not require them.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Text from GitHub Advisory Database

Affected versions 2

  • n8n, npm< 2.42.1GitHub
  • n8n, npm< 2.41.4GitHub