One `__proto__` away from losing every credential in your n8n instance

CVE-2026-33696 turns anyone who can create or edit an n8n workflow into remote code execution as the n8n process user. That should bother you even if you trust your editors, because the n8n process holds the encryption key for every credential stored in the instance. RCE here is not a foothold. It is the keyring.

The chain, compressed

The GSuiteAdmin node's Custom Fields section takes schema name, field name, and value straight from workflow config:

customSchemas[schemaName] ??= {};

(customSchemas[schemaName] as IDataObject)[fieldName] = value;