DEV Community

Jason Miller
Jason Miller

Posted on Originally published at axeploit.com

One `__proto__` away from losing every credential in your n8n instance

#n8n #cve202633696 #prototypepollution #remotecodeexecution

CVE-2026-33696 turns anyone who can create or edit an n8n workflow into remote code execution as the n8n process user. That should bother you even if you trust your editors, because the n8n process holds the encryption key for every credential stored in the instance. RCE here is not a foothold. It is the keyring.

The chain, compressed

The GSuiteAdmin node's Custom Fields section takes schema name, field name, and value straight from workflow config:

customSchemas[schemaName] ??= {};
(customSchemas[schemaName] as IDataObject)[fieldName] = value;
Enter fullscreen mode Exit fullscreen mode

Set schemaName to __proto__ and the guard defeats itself. The ??= reads customSchemas["__proto__"], which hits the prototype getter and returns Object.prototype, a truthy value, so the empty-object assignment never runs. Line two writes your field name and value directly onto Object.prototype. Every plain object created afterward inherits the property.

The escalation: a downstream Git node calls simple-git, whose .env() allocates a plain {} that now carries the polluted key. Node's spawn() copies inherited properties into the child environment, and git executes GIT_SSH_COMMAND when cloning an SSH-style URL. Webhook to GSuiteAdmin to Git. One POST.

Two things defenders miss. The pollution happens before the Google API call, so a failed GSuiteAdmin node in your execution log does not mean the attack failed. And pollution persists until restart. Even without the git gadget, junk on Object.prototype breaks TypeORM's buildWhere (it iterates with for...in) and every query throws EntityPropertyNotFoundError. A clumsy attacker takes your platform down by accident.

Patching has a trap in it

Fixed versions are 2.14.1, 2.13.3, and 1.123.27. Version 2.14.0 is still vulnerable, so "we're on the latest 2.14" proves nothing. Check the exact string.

Also check your workflows for the XML node. The advisory (GHSA-mxrg-77hm-89hv) covers it too, but nearly everything written about this CVE mentions only GSuiteAdmin, and the vendor's interim NODES_EXCLUDE mitigation disables only the XML node. GSuiteAdmin stays reachable. The patched release is the only real fix, and you need a restart after applying it, because a package update does not unpollute a running process.

On the fix itself: blocklisting dangerous keys is the floor, not the goal. Blocklists decay, because every future code path writing user-controlled keys has to remember to apply one. The durable pattern is to stop using plain objects as maps for untrusted keys (Object.create(null) or Map) and route merges through the guarded deepMerge n8n already ships.

Hunting it on your instance

Workflow definitions persist in the database, so an attempt leaves an artifact:

SELECT id, name FROM workflow_entity
WHERE nodes LIKE '%__proto__%'
   OR nodes LIKE '%constructor%'
   OR nodes LIKE '%prototype%';
Enter fullscreen mode Exit fullscreen mode

Adjust names for Postgres vs SQLite. constructor will be noisy; a quoted __proto__ almost never appears legitimately.

Then correlate: a GSuiteAdmin node failing at its Google API call followed by a Git node in the same run, and EntityPropertyNotFoundError anywhere in server logs. Either one means treat every credential in that instance as compromised.

On the process side, watch for n8n spawning things it shouldn't (sh, ssh, curl, wget), and for a git child carrying GIT_SSH_COMMAND with shell metacharacters. Baseline first if you use Execute Command nodes. If webhooks sit behind a proxy, log request bodies containing __proto__ or GIT_SSH_COMMAND, but alert rather than block for the first week.

The "needs authentication" dismissal is thinner than it sounds. Low-code exists so non-engineers can build automation, so editor rights get handed out far wider than SSH ever would. The PoC is public and costs one curl. And this was not the only auth-to-impact n8n bug patched in the same window: CVE-2026-33663 let member-level users read plaintext HTTP credentials, and CVE-2026-33660 turned the Merge node's SQL mode into file read and RCE. The permission model quietly assumes editors can be trusted with the server. This CVE prices that assumption.

Do today:

  • Verify the exact version string: 2.14.1, 2.13.3, or 1.123.27. Restart after patching, no exceptions.
  • Run the SQL sweep and grep logs for EntityPropertyNotFoundError. A hit means rotate everything the instance stores.
  • Audit the workflow editor list like it is sudo access, because functionally it is.

Honest question: when someone in your org gets n8n edit rights, does security review treat it as equivalent to shell on that host? I have never seen a place where it does.

Longer writeup with the full chain and more detection ideas: https://axeploit.com/blog/one-schema-name-every-stored-credential-cve-2026-33696-and-the-n8n-blast-radius

Top comments (0)