CVE-2026-33696: 
NixOS vulnerability analysis and mitigation

CVE-2026-33696 is a prototype pollution vulnerability in the n8n open-source workflow automation platform, specifically affecting the XML and GSuiteAdmin nodes. An authenticated user with permission to create or modify workflows can supply crafted node configuration parameters to write attacker-controlled values onto Object.prototype, ultimately enabling remote code execution (RCE) on the n8n instance. Affected versions include all releases prior to 1.123.27 (v1 branch), 2.0.0-rc.0 through 2.13.2 (v2 branch), and version 2.14.0 specifically. The vulnerability was published on March 25, 2026, with patches released the same day. It carries a CVSS v4.0 base score of 9.4 (Critical) and a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, n8n Security Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The vulnerability exists because the XML and GSuiteAdmin nodes in n8n do not properly sanitize or restrict user-supplied parameters during node configuration, allowing an attacker to inject keys such as __proto__ or constructor.prototype into objects processed by the platform. By polluting Object.prototype with attacker-controlled values, the attacker can influence the behavior of JavaScript objects across the entire Node.js runtime, which can be chained to achieve RCE. Exploitation requires network access and low-privilege authenticated credentials (workflow creation or editing permissions), with no user interaction needed (GitHub Advisory, n8n Security Advisory).

Successful exploitation grants an attacker full remote code execution on the n8n server, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive workflow data and credentials stored within n8n, tamper with or delete automation workflows, and use the compromised server as a pivot point for lateral movement within the broader infrastructure. The CVSS v4.0 scoring reflects high impact on both the vulnerable system and subsequent systems, underscoring the potential for cascading damage beyond the n8n instance itself (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.21–0.33%, placing it in the 44th percentile for exploitation likelihood within 30 days (GitHub Advisory). No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and the broad deployment of n8n in enterprise automation environments make this an attractive target.

1. Reconnaissance: Identify n8n instances running vulnerable versions (< 1.123.27, 2.0.0-rc.0 to < 2.13.3, or = 2.14.0) using internet scanning tools such as Shodan or Censys, or by enumerating internal services.
2. Obtain authenticated access: Acquire credentials for an n8n account with workflow creation or editing permissions — this could be via phishing, credential stuffing, or a free/trial account on a self-hosted instance.
3. Create or edit a workflow: Log in to the n8n web interface and navigate to the workflow editor to create a new workflow or modify an existing one.
4. Configure a malicious XML or GSuiteAdmin node: Add an XML or GSuiteAdmin node to the workflow and supply crafted parameters in the node configuration that include prototype pollution payloads (e.g., keys like __proto__, constructor, or prototype with attacker-controlled values).
5. Trigger prototype pollution: Save and execute the workflow, causing n8n to process the malicious node parameters and write attacker-controlled values onto Object.prototype within the Node.js runtime.
6. Achieve RCE: Chain the prototype pollution with a suitable gadget chain present in the n8n runtime or its dependencies (e.g., via alasql or similar libraries) to escalate from prototype pollution to arbitrary command execution on the server (GitHub Advisory, AnonHaven).

• Logs: n8n application logs showing workflow execution by accounts with recently granted or unusual workflow editing permissions; unexpected errors related to Object.prototype manipulation or JavaScript runtime anomalies in server logs.
• Network: Outbound connections from the n8n server to unknown external IP addresses or domains following workflow execution; unusual DNS queries originating from the n8n process.
• File System: Unexpected new files, scripts, or binaries written to the n8n working directory or system temp directories; new cron jobs or scheduled tasks created under the n8n service account.
• Process: Unusual child processes spawned by the n8n Node.js process (e.g., sh, bash, curl, wget, python, nc); unexpected network listeners opened by the n8n process.
• Application: Workflow configurations containing node parameters with keys such as __proto__, constructor, or prototype; newly created workflows by non-administrative users containing XML or GSuiteAdmin nodes with complex nested parameter structures.

Users should upgrade n8n to one of the patched versions: 2.14.1, 2.13.3, or 1.123.27 (or any later release). If immediate upgrading is not possible, two temporary mitigations are available: (1) restrict workflow creation and editing permissions to fully trusted users only, and (2) disable the XML node by adding n8n-nodes-base.xml to the NODES_EXCLUDE environment variable. Note that these workarounds do not fully eliminate the risk — they reduce the attack surface but do not address the GSuiteAdmin node vector — and should only be used as short-term measures while planning for patching (n8n Security Advisory, GitHub Advisory).

Heise Online covered the vulnerability, describing it as one of two critical RCE vulnerabilities threatening the n8n automation platform and urging immediate patching (Heise). The Belgian Centre for Cybersecurity (CCB) issued an advisory warning of critical vulnerabilities in n8n and recommending immediate patching (CCB Belgium). The vulnerability was discussed on Reddit's r/blueteamsec community and referenced in The Hacker News weekly recap, indicating moderate security community interest (Reddit, The Hacker News). Greenbone included it in their March 2026 threat report as a notable critical risk (Greenbone).