n8n, the self-hosted workflow automation platform covered regularly on this site, published its bi-weekly security update on September 16, 2026. The bulletin, posted on the official n8n Community forum by a member of the n8n security team, discloses 16 advisories fixed since the previous update on September 2: 12 rated High severity and 4 rated Medium. It’s the largest High-severity batch in this recurring series so far, up from 5 in early September and 6 in August, and the third n8n security bulletin we’ve covered here this year.
The cadence itself is worth noting: n8n’s security team has now shipped a bulletin roughly every two weeks for months. That predictability matters if you run a self-hosted instance without constant supervision. You can reasonably plan to check for updates on a similar schedule instead of waiting for an alarming headline.
The most serious fix: unauthenticated chat history disclosure
Of the sixteen advisories, one stands out because n8n’s own title flags it as unauthenticated: a NoSQL injection in the MongoDB Chat Memory node that allows unauthenticated cross-session chat history disclosure (GHSA-w24g-6454-7w7f). Most of the other High-severity issues in this batch assume the attacker already has some level of access, such as a workflow editor role or a specific node already configured in a workflow. This one doesn’t require that starting point. If you use the MongoDB Chat Memory node in any AI or chat-based workflow, patch that instance first.
Credential handling: five advisories
Five of the twelve High-severity advisories involve how n8n stores, tests, or exposes credentials:
- Duplicate node IDs can bypass the workflow credential tamper guard, exposing credentials to a shared workflow editor (GHSA-7gjv-rcf8-x5qc)
- The inline Agent node’s tool-introspection feature can decrypt any instance credential without an ownership check (GHSA-9rhv-fhr8-7q5r)
- The credential test endpoint resolves project-scoped variables from an attacker-controlled project ID (GHSA-7gvh-q9w3-wqqx)
- The dynamic credentials authorize endpoint can leak a session token to an attacker-controlled resolver (GHSA-rx55-8qhx-4hwx)
- Wekan and Baserow credentials can leak the account password to an unvalidated host through a preAuthentication hook (GHSA-gx6g-2hm7-c4xf)
As with most of this batch, these require some existing level of access to an instance or workflow rather than being opportunistic, internet-facing exploits. They matter most for instances shared between multiple users or teams.
Injection and path traversal in database and service nodes
Another five High-severity advisories cluster around injection and path traversal in nodes that talk to external databases and services:
- SQL injection in the Oracle Database node’s Delete Table drop operation (GHSA-4wf3-rgqr-xcp3)
- PostgREST filter injection through the Supabase node’s string-mode filters (GHSA-xrqg-3xcp-h45x)
- Path traversal and query injection through the Supabase node’s table name field (GHSA-rqch-9jrh-cr8w)
- Path traversal in signed resume URL generation, which enables cross-project approval forgery (GHSA-597w-c3jh-g8fg)
- Path traversal in the n8n node that redirects Public API calls to unintended resources (GHSA-89p4-6h98-c7xm)
Supply chain: community package validation
The last High-severity advisory covers the supply chain: a community package install validation bypass through PubSub in queue mode deployments (GHSA-fmmv-p585-7c8x). It matters if you run n8n in queue mode and allow community package installation on your instance.
Four medium-severity fixes
The remaining four advisories are rated Medium severity:
- Missing webhook signature verification in the Webflow Trigger node (GHSA-hwv9-jhc7-f7c4)
- Stored DOM XSS through resource locator dropdown link handling (GHSA-c2wp-6fgc-xjq4)
- Unescaped parameter interpolation into third-party query languages, which allows filter bypass and bulk data disclosure (GHSA-5pg9-2vqx-r6jm)
- Approval bypass in the Send and Wait node’s “Approve Within Chat” mode (GHSA-342v-gmh6-738j)
Patched versions and what to do
n8n has shipped fixes across all three release lines: v1.123.80 on the v1 branch, v2.40.1 on Beta, and v2.39.6 on Stable. n8n Cloud instances are patched automatically, so cloud users don’t need to take any action. If you’re self-hosting a version below these, update your instance. Prioritize it if you use the MongoDB Chat Memory node, given the unauthenticated disclosure issue described above.
The bulletin doesn’t publish CVSS scores or note evidence of active exploitation for any of these sixteen advisories. Treat this as routine, if unusually large, maintenance rather than an emergency. Full per-advisory remediation notes are available in the official bulletin on the n8n Community forum.