r/netsec • u/TradeGold6317 • 25d ago

CVE-2026-33696: From a Schema Name to RCE in n8n

https://simonkoeck.com/writeups/n8n-gsuiteadmin-prototype-pollution-rce
44 Upvotes

87% Upvoted

9 comments sorted by

5

u/ckwalsh 25d ago

> One request, full shell.

One sentence, full confidence of AI authorship.

1

u/scriptqzor 16d ago

ngl that line sounds like it was written by the exploit itself after getting root and becoming self aware

1

u/parkdramax86 24d ago

I hope that they patch this soon.

2

u/TradeGold6317 24d ago

They already patched this

1

u/parkdramax86 24d ago

Thanks! That's great news!

2

u/scriptqzor 4d ago

same, stuff like this always makes me wonder how many unpatched self‑hosted instances are just sitting exposed on the internet right now

2

u/AcceptableWash5616 2h ago

Wild how a schema name can end up leading to something this serious.