If you self-host n8n, update it today: the 14 October 2026 security bulletin fixes 15 vulnerabilities, five rated High, and one of them (in the Slack Trigger node) needs no login at all. Move to 1.123.85 on the 1.x branch, 2.43.5 or later on 2.x stable (2.43.7 is current) or 2.44.1 or later on beta (2.44.3 is current). n8n Cloud has already been patched.
Last updated 16 October 2026. Sources are linked in the text and listed at the end.
What changed
n8n now publishes a security update every two weeks. The 14 October bulletin lists 15 GitHub security advisories and three fixed releases: 1.123.85, 2.43.5 (stable) and 2.44.1 (beta). Early coverage put the count at eight; the bulletin and the advisory list on GitHub both show 15. None has a CVE ID yet, so track them by GHSA ID.
The five High issues, as the bulletin rates them:
- GHSA-mp7q-23hg-35cf, stored XSS (CVSS 4.0 score 8.4). Some webhook response paths, such as error responses, skipped the sandbox Content-Security-Policy. A member who can create and activate workflows can serve HTML that runs on the n8n origin with the session of whoever opens the webhook URL.
- GHSA-wvjj-qg37-pv73, cross-project Data Tables (7.2). A crafted workflow ID broke the project ownership check, so a member could list, read, change and delete Data Table rows in every project. 2.x only.
- GHSA-m7gv-mpg5-7c9v, glob denial of service (7.1). A wildcard-heavy File(s) Selector in the Read/Write Files from Disk node blocks the event loop, taking down the UI, API, webhooks and health checks until a restart.
- GHSA-fvv4-gmv9-xqf5, prototype pollution in workflow history (7.1). A specially named connection key, processed by the history compaction task, leaves the instance returning server errors for logins and writes. Fixed earlier in 2.41.4 and 2.42.1, so current 2.x builds already carry it.
- GHSA-qmvv-q3c9-wpp7, secrets in error data. The Git, MongoDB Atlas Vector Store and Google Cloud Storage nodes stored a credential secret in failed execution data, readable by anyone who can view executions. The bulletin calls it High; the GitHub advisory scores it Medium (5.3).
Of the ten Medium issues, two matter more than their rating suggests for anyone with webhooks on the internet. GHSA-3c3p-5959-3ghr: when a Slack credential has no signing secret, the Slack Trigger webhook accepted unsigned requests, so an unauthenticated caller who knows the URL could have the workspace token sent to a host they choose (fixed from 1.123.83). GHSA-65mv-v8rp-54wc and GHSA-mgpr-56r4-5c67 are filter injections in the Quick Base and Microsoft Outlook/SharePoint v1 nodes: if a workflow feeds webhook input into those fields, an outside caller can widen the query, up to deleting every Quick Base record the credential can reach.
The rest need an account: three credential permission check bypasses (GHSA-v9cx-v88r-42vw, GHSA-8vrr-mgc5-jg55, GHSA-8crx-5h96-q72q) that let a member or editor send a credential they cannot read to their own server, per-user credential theft through error workflows (GHSA-pcr3-v5vr-qppf, 2.x only), Chat Hub users adding tool types their role should not get (GHSA-43v8-hjhm-chjp), and a SeaTable API token saved in failed poll data (GHSA-crfj-5wv6-8v86). The last one, GHSA-cwm2-vhf5-27q9, affects the Local Gateway desktop app: a crafted link could re-pair it to an attacker’s instance.
What it means for your homelab
Most of these bugs turn a low-privilege account into something worse, so a single-owner instance is less exposed than a shared one. That does not make it safe to wait. If your n8n has webhooks reachable from the internet, the Slack Trigger and filter injection issues need no account on your instance. If you have given a family member, a client or a test account access, the credential bypasses mean any of them could pull secrets you never shared. And the two denial-of-service bugs can stop every automation you rely on.
Until you can patch, n8n’s advisories suggest: limit the instance to trusted users, set a signing secret on every Slack credential used by a Slack Trigger, and set N8N_SSRF_PROTECTION_ENABLED=true. After patching, rotate the Slack token if a Slack Trigger without a signing secret was exposed, and rotate any Git, MongoDB, Google Cloud Storage or SeaTable credentials that appear in failed executions other people could view.
How to check your version
In the editor, open Help, then About n8n. From the shell, in the folder with your compose file (swap n8n for your service name if it differs):
docker compose exec n8n n8n --version
docker compose images n8nBelow 1.123.85 on 1.x, below 2.43.5 on stable or below 2.44.1 on beta means you are exposed. Stay on your branch: beta users need the beta fix.
How to update a Docker Compose install
Back up first. n8n runs database migrations on start, so going back to an older image after an upgrade is only reliable with a copy of the data taken before it. With the default SQLite setup, everything (workflows, credentials and the encryption key file, unless you set N8N_ENCRYPTION_KEY yourself) lives in the volume mounted at /home/node/.n8n. Stop the container so the database is not mid-write, then archive the volume:
# find the volume name (Compose prefixes it with the project name)
docker volume ls | grep n8n
docker compose stop n8n
docker run --rm -v n8n_data:/data:ro -v "$PWD":/backup alpine \
tar czf /backup/n8n_data-$(date +%F).tar.gz -C /data .If you run n8n on PostgreSQL, take a pg_dump of its database as well. Then update the image. If your compose file pins a version, change the tag, for example image: docker.n8n.io/n8nio/n8n:2.43.7. If it tracks latest or stable, a pull is enough:
docker compose pull n8n
docker compose up -d n8n
docker compose logs -f n8nWatch the logs until migrations finish and the editor URL is printed, run the version check again, then trigger one webhook workflow and one scheduled workflow by hand to confirm they still run. The releases since 2.43.5 (2.43.6 and 2.43.7) are small bug fixes and a worker shutdown change, with nothing marked as breaking.
Career Context: This bulletin is a good exercise in reading a CVSS 4.0 vector rather than the label. PR:N (no privileges needed) on a Medium can matter more to an internet-facing instance than PR:L on a High. Triage by who can reach it, then by score: it is the same call a vulnerability management analyst makes every week.
Sources
- Security update, 14 October 2026 (n8n community forum, official bulletin)
- n8n security advisories (GitHub, per-advisory affected and fixed versions, CVSS 4.0 vectors)
- n8n releases (GitHub, 2.43.5 to 2.43.7 and 2.44.1 to 2.44.3 release notes)
- Docker installation and update (n8n docs)
- n8n Patches Multiple Security Vulnerabilities Affecting Self-Hosted Installations (noted.lol)
ReadTheManual is run, written and curated by Eric Lonsdale.
Eric has over 20 years of professional experience in IT infrastructure, cloud architecture, and cybersecurity, but started with PCs long before that.
He built his first machine from parts bought off tables at the local college campus, hoping they worked. He learned on BBC Micros and Atari units in the early 90s, and has built almost every PC he’s used between 1995 and now.
From helpdesk to infrastructure architect, Eric has worked across enterprise datacentres, Azure environments, and security operations. He’s managed teams, trained engineers, and spent two decades solving the problems this site teaches you to solve.
ReadTheManual exists because Eric believes the best way to learn IT is to build things, break things, and actually read the manual. Every guide on this site runs on infrastructure he owns and maintains.
Enjoyed this guide?
New articles on Linux, homelab, cloud, and automation every 2 days. No spam, unsubscribe anytime.
