Cyber Posture

CVE-2026-42231

High

Published: 04 May 2026

Published
04 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 53.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-42231 is a high-severity Prototype Pollution (CWE-1321) vulnerability in N8N N8N. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Prototype pollution in webhook XML parser (public-facing) chained to Git SSH for RCE enables T1190 (public app exploit) and T1068 (priv esc to host code exec).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An…

more

authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n host. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-1321

Affected Products

n8n
n8n
2.18.0 · ≤ 1.123.32 · 2.17.0 — 2.17.4

CVEs Like This One

CVE-2026-33696Same product: N8N N8N
CVE-2026-42232Same product: N8N N8N
CVE-2026-25056Same product: N8N N8N
CVE-2026-33665Same product: N8N N8N
CVE-2026-33749Same product: N8N N8N
CVE-2026-25115Same product: N8N N8N
CVE-2026-27495Same product: N8N N8N
CVE-2026-25049Same product: N8N N8N
CVE-2025-68613Same product: N8N N8N
CVE-2025-62726Same product: N8N N8N

References