n8n self-hosted: 5 high-severity flaws patched, update now
On October 14, 2026, n8n published a security bulletin covering eight vulnerabilities. Five are classified as High severity. If you run a self-hosted n8n instance, especially one where multiple users can build or edit workflows, this patch is not optional.
What Got Fixed
- Stored XSS (CVSS 8.4): Malicious HTML returned through webhook responses could execute JavaScript inside another user’s authenticated session.
- Cross-project data access (CVSS 7.2): A specially crafted workflow ID could let a restricted user read or modify Data Tables belonging to a different project.
- Prototype pollution (High): A workflow history vulnerability could cause denial of service.
- File operation denial of service (High): Crafted glob patterns in the Read/Write Files node could block the application’s event loop.
- Credential exposure: Certain node execution errors could reveal sensitive credential data to users with access to execution logs.
Which Versions Are Patched
n8n has released fixes across all active branches:
- n8n 1.x: update to 1.123.85 or newer
- n8n 2.x stable: update to 2.43.5 or newer
- n8n 2.x beta: update to 2.44.1 or newer
Cloud-hosted n8n instances have already been patched automatically. Self-hosted Docker users need to pull the updated container image and recreate the container while preserving persistent data. No confirmed active exploitation has been reported as of the bulletin date.
Who This Affects Most
The stored XSS and cross-project data access issues are the ones to prioritize. Both require multi-user environments to be exploitable, but if you are hosting n8n for a team or running automations that touch credentials, API keys, or shared data, the risk surface is real. Update, then check your execution logs for anything anomalous.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
