Executive brief
n8n is an automation platform used to connect different software services and automate business workflows. A security flaw allows users with workflow creation permissions to crash the entire n8n server by providing a specially crafted value in the Microsoft SQL node. This results in a complete service outage, making the platform unusable for all users until a manual restart is performed.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the Microsoft SQL node of n8n. An authenticated attacker with privileges to create or edit workflows can exploit this by supplying a malicious value to the 'table' parameter. This action modifies the 'Object.prototype' globally across the Node.js process. The resulting pollution causes widespread validation failures within the application logic, leading to a persistent Denial of Service (DoS) that lasts until the server process is restarted. The vulnerability is fixed in version 2.24.0; workarounds include restricting workflow permissions or excluding the 'microsoftSql' node via environment variables.
Affected products
- n8n-io n8n < 2.24.0
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date