If your n8n is below the version listed for your release line, update it. The full advisories are on the n8n security page.
Last 90 days: 106 advisories published.
Latest stable release: 2.43.6 (Oct 15, 2026).
Minimum version that fixes the advisories, per release line:
- 2.44.x line (pre-release on GitHub): 2.44.1 or later.
- 2.43.x line: 2.43.5 or later.
- 2.42.x line: 2.42.2 or later.
- 2.41.x line: 2.41.5 or later.
- 1.123.x line: 1.123.85 or later.
If your version is on a line that isn't listed above, the recent advisories don't list a fix for it: update to the latest stable release (2.43.6). The latest pre-release, 2.44.2 (Oct 15, 2026), is a test build and isn't the one to run in production.
GitHub data for n8n checked on Oct 15, 2026. Some advisories only affect certain nodes or features: open the advisory to see whether it applies to how you use n8n.
Recent advisories
| Published | Advisory | Fixed in |
|---|
Oct 14, 2026
severity medium | OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
GHSA-mgpr-56r4-5c67 | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
GHSA-8vrr-mgc5-jg55 | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
GHSA-crfj-5wv6-8v86 | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
GHSA-8crx-5h96-q72q | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
GHSA-v9cx-v88r-42vw | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Per-User Credential Theft via Error-Workflow Execution Context Inheritance
GHSA-pcr3-v5vr-qppf | >= 2.42.2
>= 2.41.5 |
Oct 14, 2026
severity medium | Local Gateway Deep-Link Connect Silently Re-pairs to Attacker-Controlled Instance
GHSA-cwm2-vhf5-27q9 | >= 2.42.1
>= 2.41.4 |
Oct 14, 2026
severity medium | Unauthenticated Slack Token Exfiltration and Full-Response SSRF via the Slack Trigger Webhook
GHSA-3c3p-5959-3ghr | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Oct 14, 2026
severity medium | Chat Hub: chat-only users can register tool types the product already tries to sandbox
GHSA-43v8-hjhm-chjp | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Quick Base Node Allows Filter Injection Through the Where Parameter
GHSA-65mv-v8rp-54wc | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity medium | Credential Secrets Exposed in Execution Error Data of Several Nodes
GHSA-qmvv-q3c9-wpp7 | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity high | Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
GHSA-m7gv-mpg5-7c9v | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity high | Crafted Workflow ID Gives Access to Data Tables in Other Projects
GHSA-wvjj-qg37-pv73 | >= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity high | Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
GHSA-mp7q-23hg-35cf | >= 1.123.85
>= 2.44.1
>= 2.43.5 |
Oct 14, 2026
severity high | Prototype Pollution in Workflow History Compaction Causes Denial of Service
GHSA-fvv4-gmv9-xqf5 | >= 2.41.4 |
Sep 30, 2026
severity medium | Cross-Project Agent Ownership Transfer via Client-Supplied Agent ID
GHSA-2r5r-xgvc-rj4p | >= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity medium | Prototype Pollution in the AI Workflow Builder Connection Merge
GHSA-3p2g-2wpm-8h3g | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity medium | Unauthenticated Cross-Project Workflow Execution via Webhook Path-Only Resolution
GHSA-4c7j-qff5-r9cx | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity medium | Cross-User Agent Chat Resume Allows Hijacking Another User's Pending Tool Approval
GHSA-p3pg-xw4f-m72c | >= 2.42.0
>= 2.41.4 |
Sep 30, 2026
severity high | n8n Chat Trigger Stored XSS via customCss Parameter on Hosted-Chat Page
GHSA-x5cw-hm7v-q7mj | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Code Execution in the Git Node Log Operation via Unneutralized Repository Configuration
GHSA-x8wx-g24x-3549 | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Execute Sub-workflow Inline JSON Allows Member to Spoof Workflow Identity for Credential Authorization, Static Data, and Error-Workflow Dispatch
GHSA-866p-xg8v-g2q7 | >= 1.123.83 |
Sep 30, 2026
severity high | Shared Prototype Mutation Through the MCP Workflow-Validation Interpreter Allows Owner Account Takeover
GHSA-5jr4-xmvf-frmj | >= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Send-and-Wait HMAC Bypass Allows Unauthenticated Approval of Waiting Executions
GHSA-728h-pmr2-7cgh | >= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Shared-Workflow Credential Check Misses Agent Node Parameter Credentials
GHSA-x25p-9mr6-cwgp | >= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | SQL Injection in the Microsoft SQL Node via Expression Interpolation into the Query Field
GHSA-5qpp-pqww-h7fp | >= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Shared-Workflow Credential Check Misses Nested and Tool Inline Sub-Workflows
GHSA-r6g9-5cpp-ppwr | >= 1.123.83 |
Sep 30, 2026
severity high | Stored XSS via Same-Origin Blob URL in the Binary-Data File Preview
GHSA-29xw-66fq-4xc3 | >= 1.123.83
>= 2.42.1
>= 2.41.4 |
Sep 30, 2026
severity high | Unauthenticated Unbounded OAuth Client Persistence via the Authorize Endpoint
GHSA-3qcw-p65v-c7vq | >= 2.42.1
>= 2.41.4 |
Sep 16, 2026
severity medium | Approval Bypass in the Send and Wait Node's Approve Within Chat Mode
GHSA-342v-gmh6-738j | >= 2.40.1
>= 2.39.6 |
Showing the 30 most recent of 106 advisories from the last 90 days. The full list is on the n8n security page.
How to update
If you installed with Docker Compose following the Docker Compose guide, pull the new image and recreate the container (docker compose pull and then docker compose up -d). Take a backup first, because that is where the SQLite database and the encryption key live (docs). The full walkthrough, including how to roll back, is in how to update n8n.
Frequently asked questions
How do I check which n8n version I have?
Run n8n --version on the server. With Docker Compose, run docker compose exec n8n n8n --version in the project folder.
How do I update n8n on Docker?
Back up the data volume, run docker compose pull and then docker compose up -d. The container is recreated with the new image.
Does every security advisory affect my installation?
Not necessarily. Many advisories affect only certain nodes or features. Open the advisory to see whether it applies to how you use n8n, but keeping n8n up to date is the safest route.