CVE-2026-44789: n8n: HTTP Request Node Pagination Prototype Pollution to RCE

Synopsis

Prototype pollution via unvalidated HTTP Request node pagination parameter affects n8n, an open source workflow automation platform. The vulnerability is reachable over the network by any authenticated user with workflow create or modify permissions, meaning no elevated privileges are required beyond a standard account. Successful exploitation enables global prototype pollution on the n8n instance which, combined with follow-on techniques, gives the attacker remote code execution. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP Request node pagination parameter is exposed over the network, so the attacker must be able to reach the n8n instance across the network.

• AuthenticationRequired

  Any low-privilege account with permission to create or modify workflows is sufficient; no admin credentials are needed.

• Victim interactionNot required

  No victim interaction is required; the attacker submits the malicious pagination parameter directly without relying on any other user's action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions beyond the authentication barrier.

Blast Radius

• Reads sensitive data stored on the n8n instance, including workflow credentials, API keys, and environment variables accessible to the process.
• Modifies workflow definitions and persisted configuration, allowing an attacker to alter automation logic across the instance.
• Crashes or destabilizes the n8n service by corrupting the JavaScript prototype chain, causing unpredictable behavior in the runtime.
• Achieves remote code execution on the underlying host, giving the attacker full control over the container or VM running the n8n instance.