Is CVE-2026-118649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118649 being exploited in the wild.

How severe is CVE-2026-118649?

High severity, with a CVSS score of 8.3, published 28 October 2026.

Which products and versions are affected?

N8n before 2.43.5 and 2.44.x before 2.44.1.

How is CVE-2026-118649 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118649?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118649: n8n prototype pollution in workflow ID caching

CVE-2026-118649 · Severity: high · CVSS 8.3 · Published 2026-10-28

n8n is a workflow automation platform that allows users to create and execute automated processes. A flaw in how the application caches workflow owner information allows an authenticated user to craft a specially-formed workflow ID that bypasses access controls, granting them the ability to read, modify, and delete data table records across all projects in the instance. This could lead to unauthorized access to sensitive business data and its manipulation.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-118649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118649 being exploited in the wild.
How severe is CVE-2026-118649?: High severity, with a CVSS score of 8.3, published 28 October 2026.
Which products and versions are affected?: N8n before 2.43.5 and 2.44.x before 2.44.1.
Is there a fix for CVE-2026-118649?: Yes: fixed in 2.43.5, 2.44.1. Until then: Restrict n8n instance access to fully trusted users only. Audit existing workflows for any whose stored ID is __proto__ and remove them. Disable the Data Tables module if it is not required. These are temporary measures and upgrading is strongly recommended.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"advisory","at":"2026-10-28"},{"kind":"patched","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118649 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118649?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.43.5, 2.44.1

Restrict n8n instance access to fully trusted users only. Audit existing workflows for any whose stored ID is __proto__ and remove them. Disable the Data Tables module if it is not required. These are temporary measures and upgrading is strongly recommended.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"advisory","at":"2026-10-28"},{"kind":"patched","at":"2026-10-28"}]

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the workflow ID caching mechanism. n8n accepts a client-supplied workflow ID and caches the workflow's owner project in memory by that ID; a crafted ID such as __proto__ pollutes the JavaScript prototype chain, causing subsequent Data Table project authorization checks to match every project regardless of actual ownership. An authenticated user with workflow creation and execution privileges can exploit this over the network to bypass project-level access controls and manipulate all Data Table rows.

Affected products

n8n n8n before 2.43.5 and 2.44.x before 2.44.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.