Cyber Resilience

CVE-2026-42231

Critical

Published: 04 May 2026

Published
04 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score v4 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0085 53.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-42231 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in N8N N8N. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An…

more

authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Prototype pollution in webhook XML parser (public-facing) chained to Git SSH for RCE enables T1190 (public app exploit) and T1068 (priv esc to host code exec).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33696Same product: N8N N8N
CVE-2026-42232Same product: N8N N8N
CVE-2026-33665Same product: N8N N8N
CVE-2026-25056Same product: N8N N8N
CVE-2026-27495Same product: N8N N8N
CVE-2026-25049Same product: N8N N8N
CVE-2026-33749Same product: N8N N8N
CVE-2026-25115Same product: N8N N8N
CVE-2026-27494Same product: N8N N8N
CVE-2026-21877Same product: N8N N8N

Affected Assets

n8n
n8n
2.18.0 · ≤ 1.123.32 · 2.17.0 — 2.17.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References