Cyber Resilience

CVE-2026-42232

Critical

Published: 04 May 2026

Published
04 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score v4 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0048 37.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-42232 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in N8N N8N. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with…

more

other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Authenticated workflow modification in exposed n8n instance directly enables exploitation of prototype pollution for RCE on the server.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42231Same product: N8N N8N
CVE-2026-21877Same product: N8N N8N
CVE-2026-25055Same product: N8N N8N
CVE-2026-1470Same product: N8N N8N
CVE-2025-68613Same product: N8N N8N
CVE-2026-33696Same product: N8N N8N
CVE-2025-62726Same product: N8N N8N
CVE-2025-61917Same product: N8N N8N
CVE-2026-27497Same product: N8N N8N
CVE-2026-33665Same product: N8N N8N

Affected Assets

n8n
n8n
2.18.0 · ≤ 1.123.32 · 2.17.0 — 2.17.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References