n8n Fixes 12 Security Flaws, Three Rated High for Code Execution. Update to 2.45.5 or 1.123.89

TL;DR: n8n, the workflow automation tool many small teams self-host, published 12 security advisories on October 28, 2026. Three are rated High, and each can lead to code running on your n8n server: through workflow expressions, through the Edit Image node in the official Docker image, and through old Code-style nodes. The fixes are in 2.45.5 (current stable), 2.46.1 (beta), 3.0.1 (pre-release) and, for six of the 12, 1.123.89. No attacks have been reported, and no CVE IDs had been assigned at our check.

What happened

The advisories: n8n posted 12 advisories to its GitHub security page on October 28, 2026, between 08:47 and 08:49 UTC (4:47 to 4:49 p.m. Manila). The fixed releases had shipped earlier the same day, but their release notes don’t mention the security fixes, so you’d only know from the advisories. n8n rates three High and nine Medium.

The three High-rated flaws:

• Old Code-style nodes run code in the main n8n process (GHSA-9p7v-45m2-wxgj, CVSS 4.0 score 8.7). The Function and Function Item nodes use the vm2 sandbox, and the LangChain Code node runs user code in the main process. A logged-in user who can create or edit workflows could use them to run code outside the task-runner isolation the regular Code node gets. n8n’s fix, in 2.42.6, 2.43.3, 2.44.0 and 3.0.1, deprecates the three nodes and blocks them by default: you can’t save a workflow that adds or changes one, but workflows already saved with them keep running. Setting N8N_DEPRECATED_NODES_BLOCK=false brings the vulnerable behavior back.
• Escaping the isolation around workflow expressions (GHSA-gx3v-3x3v-f8r5, 7.7). A user with permission to create or modify workflows could break out of the isolation n8n applies when it evaluates expressions and run code on the host.
• GraphicsMagick in the official Docker image (GHSA-f2cw-9483-7vcp, 7.7). n8n says the GraphicsMagick version bundled in its official image has known flaws, so processing an untrusted image with the Edit Image node could lead to code execution. n8n’s stopgaps single out workflows that pass images from an unauthenticated Webhook node to Edit Image, so outside input can reach it.

The nine Medium-rated flaws, according to the advisories:

• The NocoDB node could send its API token to any host named in an attachment field (GHSA-jmcg-c7p5-q69g).
• Nodes that use stored credentials, other than HTTP Request v4.4, re-sent Authorization headers when a request was redirected to a different site (GHSA-prmc-fg87-r4gh).
• The Chat Trigger in embedded mode skipped n8n user authentication on one route, so anyone could read a named session’s chat history or start the workflow (GHSA-pwj5-wwm6-g83j).
• The Asana Trigger let an unauthenticated request replace its webhook secret and then send forged events (GHSA-mx4r-96jx-v278).
• The MCP OAuth endpoints, on by default, could be used as an open redirect (GHSA-rc3w-8jc8-7x3w).
• The MongoDB node’s Update and Find And Replace operations could overwrite the wrong documents when fed untrusted input (GHSA-4v22-g448-h4rg).
• The Vector Store (OracleDB) node allowed SQL injection through metadata filter keys (GHSA-2x68-96jw-5r6c).
• The Browser Use upload tool could read any file on the n8n server, but only on instances that turned Browser Use on (GHSA-9qx8-fhxv-w794).
• On Enterprise instances, an OAuth2 connect flow could store a victim’s tokens under another member’s account (GHSA-426f-xmcv-g8pg).

Which versions: Nine of the 12 advisories list 2.45.5, 2.46.1 and 3.0.1 as fixed, and six of those also list 1.123.89; the other three were fixed in earlier 2.x releases and in 3.0.1. Six of them list no 1.x fix at all, including the deprecated Code nodes flaw, so 1.123.89 doesn’t close everything. On October 29 n8n shipped 2.45.6, 2.46.2 and 1.123.90. The 1.123.90 notes include “Require a signed token to accept an invitation,” with no matching advisory at our check.

Why it matters

n8n instances hold the credentials for everything they automate: email, CRM, payments, cloud accounts and AI model APIs. Our read: code running on the server can likely reach all of them, which is why the three High flaws matter most. If you’re the only person who logs in, the two that need workflow edit rights matter less, but n8n’s own stopgaps for the Edit Image flaw point at public webhooks, and the Chat Trigger and Asana issues need no login. If you give teammates, clients or contractors accounts, all three High flaws apply. Self-hosted n8n also runs on Node.js, so check that your runtime has the October Node.js Brotli fix while you’re updating. If you’re still choosing an automation tool, our n8n vs Make vs Zapier guide covers self-hosting trade-offs, and the Security hub tracks other patches worth doing now.

What to do now

1. Check your version. In the n8n editor, open Help > About n8n in the left sidebar. With Docker, docker ps shows the image tag.
2. Update. For Docker, pull n8nio/n8n:2.45.6 (n8n’s stable and latest tags pointed to it at our check) or at least 2.45.5, and recreate the container. Pulling alone doesn’t change a running container. For npm installs, run npm install -g n8n@2.45.6 and restart. On the beta line, use 2.46.1 or later.
3. If you’re on 1.x, update to 1.123.89 or later now. Our advice: then plan the move to 2.x, because six advisories list no 1.x fix.
4. Replace the deprecated nodes. Search your workflows for Function, Function Item and LangChain Code nodes and rebuild that logic with the Code node. They’ll keep running, but you won’t be able to edit them, and leaving N8N_DEPRECATED_NODES_BLOCK at its default keeps the protection on.
5. Tighten access. Our advice: give workflow edit rights only to people you’d trust with shell access to the server, since that’s effectively what two of the High flaws allowed.
6. Check public entry points. Look for workflows that pass webhook uploads to the Edit Image node, Chat Triggers in embedded mode, and Asana Triggers. Our tip: keep them off until you’ve updated.
7. On n8n Cloud, check the version in the n8n Cloud console and update if you can. The advisories don’t say whether Cloud workspaces were patched for you.

Updates

• Oct 29, 2026, 9:00 p.m. Manila: First published.

Sources & method

Sources

• n8n security advisories on GitHub
• High: GHSA-9p7v-45m2-wxgj (deprecated Code nodes), GHSA-gx3v-3x3v-f8r5 (expression isolation), GHSA-f2cw-9483-7vcp (GraphicsMagick)
• Medium: GHSA-jmcg-c7p5-q69g, GHSA-prmc-fg87-r4gh, GHSA-pwj5-wwm6-g83j, GHSA-mx4r-96jx-v278, GHSA-rc3w-8jc8-7x3w, GHSA-4v22-g448-h4rg, GHSA-2x68-96jw-5r6c, GHSA-9qx8-fhxv-w794, GHSA-426f-xmcv-g8pg
• n8n releases on GitHub: 2.45.5, 1.123.89, 2.45.6 and 1.123.90
• n8n on npm (dist-tags and release times)
• n8nio/n8n on Docker Hub (tags)
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.28)

Method. Checked October 29, 2026, at about 7:05 p.m. Manila time (11:05 UTC). The flaw descriptions, severities, CVSS 4.0 scores, affected and fixed versions and stopgaps come from n8n’s 12 GitHub advisories; the advisory and release times come from GitHub’s records; which release is stable, beta or pre-release comes from npm’s dist-tags and GitHub’s release labels; and the Docker tags come from Docker Hub. We checked CISA’s KEV catalog (version 2026.10.28). Steps and lines labelled “our advice” and “our read” are our own judgment, not n8n’s. The thumbnail is the preview image of n8n’s GitHub repository. No affiliate links on this page. How we work.