L3 · Shartedn8n · automation · credentialsn8n-october-security-batch

n8n publishes 12 advisories covering code isolation, credential leaks and workflow authentication

n8n’s October 28 batch includes three high-severity code-execution issues and nine medium issues. Workflow editors, untrusted node inputs and enabled features create different attack paths. Update and migrate deprecated code nodes; saved workflows can keep running.

Disclosed: Oct 28, 2026; Public disclosure date
Severity: Sharted; 12 CVEs tracked here
Splash zone: n8n workflow editors or untrusted inputs reaching affected nodes; Browser Use and Enterprise OAuth have additional prerequisites; n8n
In the wild: Unknown; The advisories do not report a malicious campaign or victim counts.

What happened

L3 reflects isolation failures and credential exposure in a mainstream automation service. The twelve advisories describe different trust boundaries; they do not establish a single unauthenticated takeover path for every instance. The default block on deprecated nodes rejects newly added or modified nodes but leaves saved workflows running. Some fixes were available on earlier maintenance releases; the disclosure day is October 28. No CVE IDs are assigned in the reviewed advisories. A universal version checker is omitted because older-line coverage differs.

What’s in the bowl

GHSA-gx3v-3x3v-f8r5

Expression isolation escape

A workflow editor can execute code on the host.

GHSA-9p7v-45m2-wxgj

Deprecated code nodes bypass runners

Workflow editors can execute in the main process through Function, Function Item or LangChain Code; existing workflows still run after the default block.

GHSA-f2cw-9483-7vcp

GraphicsMagick image processing

Untrusted images reaching Edit Image in the official Docker image can cause code execution.

GHSA-9qx8-fhxv-w794

Browser Use server file read

An authenticated member connecting a browser can read server files when Browser Use is explicitly enabled; the path is resolved on the n8n server.

GHSA-pwj5-wwm6-g83j

Embedded chat authentication bypass

A published embedded Chat Trigger using n8n User Auth permits unauthenticated setup GETs to read a named session or trigger work.

GHSA-4v22-g448-h4rg

MongoDB update target manipulation

Untrusted updateKey input can make Update/Find And Replace overwrite unintended documents or insert new ones.

GHSA-426f-xmcv-g8pg

Dynamic OAuth account hijack

Enterprise resolvable OAuth2 credentials let a member capture another person’s provider tokens if that person follows the authorization URL and consents without an n8n session.

GHSA-rc3w-8jc8-7x3w

MCP OAuth open redirect

Unauthenticated client registration can redirect a visitor opening a crafted URL; no token/session data is included in that redirect.

GHSA-mx4r-96jx-v278

Asana verification-secret reset

An unauthenticated caller knowing the webhook URL can replace X-Hook-Secret and forge events while legitimate deliveries fail.

GHSA-2x68-96jw-5r6c

OracleDB vector metadata SQL injection

Untrusted metadata filter keys can read data accessible to the configured Oracle credential.

GHSA-prmc-fg87-r4gh

Cross-origin credential forwarding

Credential-using nodes can forward authentication across attacker-influenced redirects; HTTP Request v4.4 opted out of the unsafe default.

GHSA-jmcg-c7p5-q69g

NocoDB attachment token exposure

A base editor can supply an attachment URL that receives the configured API token when Download Attachments is enabled and the workflow runs.

Fixed versions

Product	Safe from	Note
n8n 2.45	`2.45.5`	Stable maintenance release
n8n 2.46	`2.46.1`	GitHub prerelease; not a routine production channel switch
n8n 3.0	`3.0.1`	GitHub prerelease; review major-version migration requirements

Crime-scene timeline

Oct 28, 2026
n8n publishes twelve advisories

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

n8n GHSA-gx3v-3x3v-f8r5PrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-9p7v-45m2-wxgjPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-f2cw-9483-7vcpPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-9qx8-fhxv-w794PrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-pwj5-wwm6-g83jPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-4v22-g448-h4rgPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-426f-xmcv-g8pgPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-rc3w-8jc8-7x3wPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-mx4r-96jx-v278PrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-2x68-96jw-5r6cPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-prmc-fg87-r4ghPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n GHSA-jmcg-c7p5-q69gPrimaryAffected node/feature, conditions, fixed releases and interim controls.
n8n 2.45.5 release metadataPrimaryOctober 28 publication, marked stable at review.
n8n 2.46.1 release metadataPrimaryOctober 28 publication, marked prerelease at review.
n8n 3.0.1 release metadataPrimaryOctober 28 publication, marked prerelease at review.

Wipe guide

The wipe checklist

0 of 6 sheets used

Upgrade all running n8n componentsPrefer the stable 2.45.5 maintenance release. GitHub marks 2.46.1 and 3.0.1 as prereleases; use those only with an appropriate release-channel/migration plan. Do not switch major versions as a routine patch. Several advisories list 1.123.89, but others do not list a 1.x fix; do not treat that version as blanket coverage. Follow each advisory for older backports.
Replace deprecated nodes even after upgradingMigrate existing Function, Function Item and LangChain Code workflows to the Code node. Keep the default block enabled; N8N_DEPRECATED_NODES_BLOCK=false restores the risky behavior. As temporary mitigation, exclude n8n-nodes-base.function, n8n-nodes-base.functionItem and @n8n/n8n-nodes-langchain.code via NODES_EXCLUDE.
Remove untrusted image and database pathsRestrict editing and webhook ingress. Disconnect unauthenticated Webhooks from Edit Image; if needed exclude n8n-nodes-base.editImage or remove unused GraphicsMagick url/svg/mvg/pcd/msl coder modules. Validate MongoDB updateKey and OracleDB Metadata Filter Name inputs; deactivate unsafe workflows until patched.
Disable unused Browser Use and bind OAuth callbacksSet N8N_INSTANCE_AI_BROWSER_USE_ENABLED=false or leave it unset if unused. For Enterprise dynamic credentials, use N8N_OAUTH_BROWSER_BINDING=true, restrict project editors and disable dynamic credentials if unnecessary. A browser approval naming a host does not establish the file path is safe.
Review chat and trigger authenticationUntil patched, deactivate embedded Chat Trigger workflows using n8n User Auth or use basic auth; restrict Asana webhook access. Limit unauthenticated /mcp-oauth/register and /mcp-oauth/authorize access and avoid unsolicited authorization links.
Contain credential forwarding and investigate exposureDisable NocoDB Download Attachments until patched. Restrict outbound destinations, enable N8N_SSRF_PROTECTION_ENABLED=true, and prevent untrusted URLs/redirects from driving credentialed requests. Rotate potentially exposed NocoDB and other workflow credentials; review execution logs. No campaign-specific IoCs are published; anomalous requests alone do not prove compromise.