n8n fixes 12 flaws, three high, including code execution escapes

n8n fixes 12 flaws, three high, including code execution escapes

28 October 2026: n8n, the workflow automation tool many companies run on their own servers, published 12 security advisories on 28 October, three rated high and nine moderate. Two of the high ones let a user who can build workflows break out of n8n's isolation and run code on the server; the third, in the image library bundled with the official Docker image, can be reached by anyone who can send an image to a public webhook. No CVE numbers have been assigned, and n8n does not report exploitation.

The three high-severity flaws

• Deprecated Code nodes (GHSA-9p7v-45m2-wxgj, CVSS 8.7): the Function and Function Item nodes run user code in the vm2 sandbox and the LangChain Code node runs it in the main n8n process, outside the task runner isolation that protects the current Code node. Versions 3.0.1, 2.44.0, 2.43.3 and 2.42.6 block the three nodes by default: saving a workflow that adds or changes one is rejected, while workflows already saved with them keep running. Setting N8N_DEPRECATED_NODES_BLOCK=false restores the vulnerable behaviour.
• Expression evaluation (GHSA-gx3v-3x3v-f8r5): a user who can create or edit workflows could escape the isolation applied to expressions and run code on the host. Fixed in 3.0.1, 2.46.1, 2.45.5 and 1.123.89.
• GraphicsMagick (GHSA-f2cw-9483-7vcp, CVSS 7.7): the GraphicsMagick build in the official n8n Docker image has known vulnerabilities, and processing an untrusted image with the Edit Image node could lead to remote code execution. A workflow that passes images from an unauthenticated Webhook node to Edit Image puts this within reach of outsiders. Same fixed versions as the expression flaw.

The nine moderate flaws

Several affect integrations that hold credentials: an unauthenticated callback in the end-user credential connect flow allowed OAuth account hijack; nodes that use credentials forwarded authentication headers when a request was redirected to another origin; the NocoDB node sent its API token to attacker-chosen hosts when downloading attachments; and MCP OAuth dynamic client registration allowed an open redirect. The others: the Browser Use upload tool could read arbitrary files from the server, the embedded Chat Trigger did not enforce n8n user authentication on every request, MongoDB node updates could change unintended documents, the OracleDB vector store node had a SQL injection through a metadata filter key, and an unauthenticated request could reset the Asana trigger's webhook verification secret.

Upgrading, and what to do until then

Self-hosted users should move to 3.0.1, or on the 2.x line to the newest 2.46 or 2.45 release, and check each advisory's patched versions against the release they run, since the fixes did not all land in the same 2.x releases. n8n Cloud is run by n8n.

n8n's stated stopgaps, which it says do not fully remove the risk: restrict workflow creation and editing to fully trusted users; add the Function, Function Item and LangChain Code nodes, and the Edit Image node if unused, to the NODES_EXCLUDE environment variable; and deactivate any workflow that feeds an unauthenticated webhook into Edit Image. After upgrading, rotating the credentials held by OAuth, NocoDB and other affected nodes is sensible where untrusted users could build workflows.

Canada's Cyber Centre listed the n8n fixes as advisory AV26-1103. Our workflow management software category lists two products.

Company profile on TrustList: n8n

Sources

• n8n GitHub security advisories (12 published 28 October), 28 October 2026
• n8n GHSA-9p7v-45m2-wxgj: Deprecated Code Nodes Allow Code Execution in the n8n Main Process, 28 October 2026
• n8n GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration, 28 October 2026
• Canadian Centre for Cyber Security AV26-1103: n8n security advisory, 29 October 2026