Cyber Resilience

CVE-2026-54312

High

Published: 23 June 2026

Published
23 June 2026
Modified
25 June 2026
KEV Added
—
Patch
—
CVSS Score v4 7.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0029 21.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-54312 is a high-severity Prototype Pollution (CWE-1321) vulnerability in N8N N8N. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Runtime Data Manipulation (T1565.003); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter.…

more

This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1565.003 Runtime Data Manipulation Impact
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

Prototype pollution directly manipulates runtime object state (Object.prototype), leading to application-wide validation failures and DoS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

n8n
n8n
≤ 2.24.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References