n8n at a glance
n8n published 12 advisories on October 28, 2026. The high-severity ones let workflow editors escape expression isolation, abuse old Function nodes, or reach code execution through the bundled GraphicsMagick. Fixed in 1.123.89, 2.45.5, 2.46.1 and 3.0.1.
n8n: status
- Affected
- n8n before 1.123.89, 2.45.5, 2.46.1 and 3.0.1 (expression isolation escape and GraphicsMagick in the official Docker image)
- n8n before 2.42.6, 2.43.3, 2.44.0 and 3.0.1 (Function, Function Item and LangChain Code nodes run outside task runner isolation)
- Enterprise instances with resolvable OAuth2 credentials, before 2.45.5, 2.46.1 and 3.0.1 (OAuth account hijack)
- CVE identifiers
- Not published
- Status as of
- Discovered by
- External researchers credited in the GitHub advisories, including NumberOreo1 and 0xNasu for the two high-severity isolation and GraphicsMagick reports
What changed with n8n
On October 28, 2026, n8n published 12 GitHub security advisories, three rated high and nine medium, with fixes in n8n 1.123.89, 2.45.5, 2.46.1 and 3.0.1. No CVE IDs were listed when this was checked. In the first high-severity flaw, a signed-in user who can create or edit workflows could escape the isolation around workflow expressions and run arbitrary code on the n8n host.
The second high-severity flaw is that the Function, Function Item, and LangChain Code nodes ran user code outside the task runner isolation used by the Code node. Fixed versions block adding or changing these nodes by default; existing workflows keep running. The third is that the GraphicsMagick bundled in the official Docker image has known flaws, so the Edit Image node could reach code execution when processing untrusted images.
The medium fixes include an OAuth account hijack in Enterprise dynamic credentials, credential headers forwarded on cross-origin redirects, a Browser Use upload tool that could read server files, an embedded Chat Trigger that did not always enforce sign-in, and an open redirect in MCP OAuth client registration.
How to fix it: n8n
1. Update
Update n8n to 1.123.89, 2.45.5, 2.46.1, 3.0.1 or later; on 2.x, the latest stable release is the simplest target. Pull the new Docker image and restart.
github.com (opens in a new tab)2. Configuration
Keep the new block on Function, Function Item and LangChain Code nodes; do not set N8N_DEPRECATED_NODES_BLOCK=false. Replace those nodes with the Code node.
github.com (opens in a new tab)3. Workaround
Until patched, limit workflow editing to fully trusted users, deactivate workflows that connect an unauthenticated Webhook to Edit Image, and use NODES_EXCLUDE to disable Edit Image and the deprecated code nodes if not needed.
github.com (opens in a new tab)4. Configuration
On Enterprise instances that cannot update yet, set N8N_OAUTH_BROWSER_BINDING=true to bind OAuth callbacks to the browser session that started them.
github.com (opens in a new tab)5. Agent instruction
Add the agent instruction below to coding agents that maintain n8n deployment files.
github.com (opens in a new tab)
Instruction for your AI agent
When you edit n8n deployment files (docker-compose, Helm values, Dockerfiles), check the n8n image tag. If it is below 1.123.89, 2.45.5, 2.46.1 or 3.0.1 for its line, propose updating it and tell the user. Never add N8N_DEPRECATED_NODES_BLOCK=false, and report any existing occurrence instead of keeping it silently.
Based on the official guidance linked below. Review it before giving it to an agent that can change your systems.
Advisories
- GHSA-gx3v-3x3v-f8r5 (expression isolation) (opens in a new tab)github.com
- GHSA-9p7v-45m2-wxgj (deprecated code nodes) (opens in a new tab)github.com
- GHSA-f2cw-9483-7vcp (GraphicsMagick) (opens in a new tab)github.com
- GHSA-426f-xmcv-g8pg (OAuth account hijack) (opens in a new tab)github.com
- n8n security advisories (opens in a new tab)github.com
Where to compare n8n
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why n8n matters for businesses
For agencies hosting n8n for clients, most of these need a signed-in user, so shared instances with many editors are the main risk. Update to the latest 2.x, limit who can edit workflows, and check for webhooks that feed the Edit Image node.
Sources for this story
- GHSA-gx3v-3x3v-f8r5: Insufficient Isolation in Workflow Expression Evaluation (opens in a new tab)Official
n8n on GitHub · github.com
- GHSA-9p7v-45m2-wxgj: Deprecated Code Nodes Allow Code Execution in the n8n Main Process (opens in a new tab)Official
n8n on GitHub · github.com
- GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration (opens in a new tab)Official
n8n on GitHub · github.com
- GHSA-426f-xmcv-g8pg: OAuth Account Hijack in the End-User Credential Connect Flow (opens in a new tab)Official
n8n on GitHub · github.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #n8n
- #automation
- #self-hosting
- #sandbox-escape