What happened
VulnCheck published CVE-2026-110842 on 2026-10-14 (CVSS 7.7 CVSSv4.0, CWE-1321 prototype pollution). The MCP workflow-validation tool evaluates caller-supplied code through an interpreter that reads inherited properties and permits assignment onto shared prototypes in the main process. A member with only a read grant can replace a built-in method with a truthy-returning one, making a server-side permission check accept a scope they do not hold; the reporter drove this to a full takeover of the instance owner's account (accounts with MFA not affected). Verified via NVD REST API and the GitHub advisory.
Why it matters
This turns the MCP agent-tooling surface — the read-only workflow:read grant that enterprises hand out to AI clients — into a privilege-escalation path to full platform owner takeover of an AI-automation control plane hosting workflows, credentials and integrations. It is a prototype-mutation primitive in the agent interpreter, exactly the class of MCP-side bug that lets an LLM-mediated request become admin access.
Attack vector
An authenticated member holding only a workflow:read grant calls the MCP workflow-validation tool with crafted code; the interpreter evaluates it in the main process, assigns onto shared prototypes, and replaces a built-in method with a truthy-returning one so server-side permission checks accept unheld scopes — chaining to takeover of the instance owner's account.
Affected systems
n8n < 2.41.4 and 2.42.x < 2.42.1 (also 1.x line before 1.123.83)
Mitigation
Upgrade to n8n 2.41.4+ or 2.42.1+ (1.123.83+ on the 1.x line). If unable to patch: disable the instance-level MCP server, enable MFA on all owner/admin accounts, and revoke workflow:read MCP OAuth grants. Advisory: GHSA-5jr4-xmvf-frmj.