The separate n8n-mcp adapter accepted workflow parameter and connection keys that could write reserved JavaScript prototype properties during update or autofix operations. The cross-tenant consequence requires n8n-mcp multi-tenant mode with a shared Node.js process; it must not be attributed to core n8n. Shared inherited state could be changed by one…
Inspect the ClaimsCase · DiggingBeagle record
n8n-mcp tool updates could pollute a shared JavaScript prototype
The separate n8n-mcp adapter accepted workflow parameter and connection keys that could write reserved JavaScript prototype properties during update or autofix operations. Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.
Scope
The cross-tenant consequence requires n8n-mcp multi-tenant mode with a shared Node.js process; it must not be attributed to core n8n. The advisory did not demonstrate arbitrary server code execution or confirm a real multi-tenant customer attack.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: A request marked preview or validateOnly should not mutate global JavaScript object state.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8NMCP-PROTOTYPE-1 · CLM-ENRICH-20261029-25 · n8n-mcp workflow update prototype pollution advisory
At a glance
Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.
Read the implicationsThe advisory did not demonstrate arbitrary server code execution or confirm a real multi-tenant customer attack.
Limits and uncertaintyFull account
The separate n8n-mcp adapter accepted workflow parameter and connection keys that could write reserved JavaScript prototype properties during update or autofix operations.
The cross-tenant consequence requires n8n-mcp multi-tenant mode with a shared Node.js process; it must not be attributed to core n8n. Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.
The advisory did not demonstrate arbitrary server code execution or confirm a real multi-tenant customer attack. Upgrade n8n-mcp to 2.98.1 or later and reject inherited prototype keys before copying untrusted structured fields.
Evidence interpretation and control boundary. A request marked preview or validateOnly should not mutate global JavaScript object state. Unsafe user-defined node, connection and parameter property names reached partial-update and auto-fixer objects, creating process-wide prototype changes that could cross tenant boundaries when one process served several users. The advisory does not by itself prove native code execution or an attack on upstream n8n.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-25The n8n-mcp prototype-pollution advisory reports that workflow property names could modify shared JavaScript prototypes, including in preview and validation-only tool paths.supported
Basis: reported finding
- supportsn8n-mcp workflow update prototype pollution advisoryprimary disclosure
GHSA-ppgm-m8rg-4wqv: autofix, preview/validateOnly and multi-tenant impact
CLM-CP23-N8NMCP-PROTOTYPE-1The separate n8n-mcp adapter accepted workflow parameter and connection keys that could write reserved JavaScript prototype properties during update or autofix operations. The cross-tenant consequence requires n8n-mcp multi-tenant mode with a shared Node.js process; it must not be attributed to core n8n. Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.supported
Basis: reported finding
- supportsn8n-mcp workflow update prototype pollution advisoryprimary disclosure
GHSA-ppgm-m8rg-4wqv: autofix, preview/validateOnly and multi-tenant impact
Implications
Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.
Controls and mitigations
- Upgrade n8n-mcp to 2.98.1 or later and reject inherited prototype keys before copying untrusted structured fields.
Unknowns and contradictions
- The advisory did not demonstrate arbitrary server code execution or confirm a real multi-tenant customer attack.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202