Skip to content

CVE-2026-42231 - n8n XML webhook prototype pollution RCE

n8n’s XML webhook body parser can be abused with crafted XML to pollute the JavaScript object prototype. In vulnerable deployments, an attacker who can create or modify workflows can chain that polluted prototype through Git-node SSH behavior and reach remote code execution on the n8n host.

This is a server/runtime deployment issue for n8n itself. Repositories that only call an external n8n instance through an API client are not directly patching this CVE, but they may need to route the finding to the owner of the n8n deployment.

Affected versions

  • Vulnerable: n8n <1.123.32
  • Vulnerable: n8n >=2.17.0, <2.17.4
  • Vulnerable: n8n >=2.18.0, <2.18.1
  • Fixed: n8n 1.123.32, 2.17.4, 2.18.1, or later on the selected release line

Indicator-of-exposure

  • The repository deploys or packages the n8n server, not only an n8n client, SDK, workflow export, or integration.
  • A deployable n8n runtime resolves to one of the affected versions through npm, Docker images, Helm charts, compose files, Terraform, Ansible, or other release manifests.
  • n8n webhook endpoints are reachable by untrusted users or by workflows that process untrusted XML request bodies.
  • Non-fully-trusted users can create or modify workflows, especially workflows containing webhook, XML, Git, SSH, command, or file-system-capable nodes.

Quick checks:

rg -n "n8n|N8N_VERSION|n8nio/n8n|NODES_EXCLUDE|webhook|xml|git" .
npm ls n8n
pnpm why n8n
yarn why n8n
docker image ls | rg 'n8n|n8nio'

Remediation strategy

  • Upgrade every controlled n8n runtime to 1.123.32+, 2.17.4+, or 2.18.1+ on the repository’s selected release line.
  • Regenerate lockfiles, deployment manifests, SBOMs, and image references so the resolved runtime is patched, not only the declared manifest.
  • Until the upgrade is deployed, limit workflow creation and editing to fully trusted administrators. Treat this as temporary containment only.
  • Review workflows that combine webhook/XML processing with Git, SSH, shell, file-system, or other host-interacting nodes.
  • Rotate credentials exposed to vulnerable workflows if exploitation is suspected, especially SSH keys, Git credentials, n8n credentials, and secrets stored in workflow-accessible environments.

The prompt 

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-42231 (n8n XML webhook prototype pollution leading
to RCE). Produce exactly one output:

- A reviewer-ready PR/change request that upgrades n8n, preserves the intended
  release line, adds deployment/operator checks, and documents short-term
  containment, or
- TRIAGE.md if this repository does not own an affected n8n runtime or safe
  patch path.

## Rules

- Scope only CVE-2026-42231.
- Distinguish n8n server deployments from n8n API clients, SDK wrappers,
  workflow exports, or documentation.
- Do not execute proof-of-concept payloads, Git-node SSH operations, shell
  commands, or webhook calls against production n8n instances.
- Do not print, snapshot, or commit n8n credentials, webhook tokens, SSH keys,
  Git credentials, workflow secrets, cookies, or environment secrets.
- Do not auto-merge.

## Steps

1. Inventory all n8n runtime references in package manifests, lockfiles,
   Dockerfiles, compose files, Helm values, Kubernetes manifests, Terraform,
   Ansible, release scripts, SBOMs, generated dependency manifests, and
   deployment runbooks.
2. Determine whether any deployable n8n runtime resolves to:
   - `n8n <1.123.32`;
   - `n8n >=2.17.0, <2.17.4`;
   - `n8n >=2.18.0, <2.18.1`.
3. If the repository only calls an externally owned n8n service, stop with
   `TRIAGE.md` naming the owning service, the evidence found, and the required
   patched versions.
4. Upgrade the vulnerable runtime on its existing release line:
   - `1.x` deployments to `1.123.32+`;
   - `2.17.x` deployments to `2.17.4+`;
   - `2.18.x` deployments to `2.18.1+`;
   - floating tags to an explicit patched tag or digest.
5. Regenerate the repository's normal dependency and deployment artifacts:
   lockfiles, rendered Helm/Kubernetes manifests, container metadata, SBOMs,
   image digests, and generated dependency reports.
6. Search workflows and configuration for XML webhooks and host-interacting
   follow-on nodes:
   - webhook nodes accepting XML request bodies;
   - XML node usage near webhook input;
   - Git, SSH, command, file-system, code, or execute-command nodes;
   - workflow author roles or tenant settings that allow untrusted editing.
7. Add a short operator runbook or PR body section named
   `CVE-2026-42231 operator actions` that states:
   - which n8n version line was upgraded;
   - whether workflow creation/editing is limited to trusted users until
     rollout completes;
   - whether XML webhook workflows exist;
   - whether risky XML-to-Git/SSH/host-interacting workflow chains were found;
   - whether credential rotation or incident review is required.
8. If the upgrade cannot deploy immediately, add temporary containment where
   this repository controls it:
   - restrict workflow creation and editing to trusted administrators;
   - disable or quarantine XML webhook workflows that process untrusted input;
   - reduce network/file-system privileges for n8n workers;
   - document residual risk because containment does not fully remediate.
9. Run available validation: package-manager install check, lockfile integrity,
   unit tests, workflow import/export tests, lint/typecheck, image build, deploy
   rendering, and dependency/security scans.
10. Use PR title:
    `fix(sec): remediate CVE-2026-42231 in n8n`.

## Stop conditions

- The repository does not deploy or package n8n.
- The n8n runtime is owned by another team or vendor and cannot be patched here.
- A fixed version cannot be consumed without a larger n8n migration.
- Validating the exploit path would require running live RCE-like payloads,
  SSH operations, or production webhook probes.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.

Verification - what the reviewer looks for

  • No deployable n8n runtime remains below 1.123.32, in 2.17.0 through 2.17.3, or on 2.18.0.
  • Lockfiles, image tags/digests, SBOMs, and rendered deployment manifests all resolve to the patched release line.
  • The PR states whether XML webhook workflows and risky Git/SSH/host-interacting chains exist.
  • Temporary workflow-author restrictions are documented if rollout is not yet complete.
  • Tests, build, deployment rendering, and dependency scans pass or unrelated failures are documented.

Watch for

  • Updating package manifests while leaving Docker tags, Helm values, or lockfiles on vulnerable versions.
  • Treating workflow author restrictions as a permanent fix.
  • Assuming internal-only n8n instances are safe when self-service workflow editing is enabled for semi-trusted users.
  • Workflow exports or fixtures that reintroduce XML webhook paths after runtime patching.

References