Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118649n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

High 8.3

In plain English

A high-severity prototype pollution in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	2.44.0 – before 2.44.1
n8n-io	n8n	0 – before 2.43.5

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

GitHub Security Advisory (GHSA-wvjj-qg37-pv73) vendor-advisory
VulnCheck Advisory: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables third-party-advisory