Read this article in French: n8n corrige 18 failles de sécurité dans sa mise à jour bi-hebdomadaire
n8n is one of the most widely deployed self-hosted workflow automation platforms, often described as the fair-code alternative to Zapier and Make. People use it to move data between apps, trigger scripts on a schedule, and glue together services that were never designed to talk to each other. Because it runs on your own server and typically holds credentials for dozens of connected accounts, its security record matters more than that of most homelab tools.
On September 2, 2026, the n8n security team published its bi-weekly security update, disclosing 18 advisories fixed since the previous update on August 20. Five are rated High severity, and thirteen are rated Medium. This cadence, a security update roughly every two weeks, is now standard practice for the project.
The high-severity fixes: two sandbox escapes leading to code execution
The two most notable advisories both involve n8n’s expression sandbox: the restricted environment where user-written expressions, small snippets used inside workflow nodes to reformat data or pull a value out of a JSON response, are supposed to run without touching the underlying server.
- GHSA-hw8v-xxg5-vvvx: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
- GHSA-6xcw-7xm6-48c6: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
In plain terms: n8n lets workflow authors write small JavaScript-like expressions that are meant to stay boxed inside a sandbox, unable to reach the host system. Both advisories describe ways to break out of that box, ending in arbitrary code execution on the machine running the n8n instance. For a self-hosted deployment, that means anyone able to influence a workflow’s expressions, including through a workflow template imported from an external source, could execute commands on your server rather than just inside the automation itself.
Three other High-severity issues were also fixed:
- GHSA-hh89-3r9w-qj3j: an unauthenticated denial-of-service through persistent storage exhaustion via the OAuth Dynamic Client Registration endpoint.
- GHSA-j535-v25q-vx3q: a ReDoS (regular expression denial-of-service) issue via the Git node’s clone path, now mitigated by a blocked-pattern filter enabled by default.
- GHSA-34ff-336r-5q23: a domain-restriction bypass via an unprotected model-search endpoint on the OpenAI Chat Model node.
The medium-severity fixes
The remaining 13 Medium-severity advisories cover a wide range of issues rather than one single theme: a disabled OIDC SSO configuration that stayed active, an anonymous approval-gate bypass via a reused WebSocket resumeToken, Generic-Auth credential decryption without an ownership check in log streaming, cross-tenant PII disclosure through project roles, cross-user disclosure of active workflow IDs, a prototype-pollution denial-of-service, a Git node sandbox restriction bypass via branch/remote configuration keys, path injection in the Elasticsearch and ElasticSecurity nodes, an unvalidated probe URL in AI credential configuration, a GitHub Trigger webhook signature-verification bypass via path reuse (HTTP 422), a sub-workflow caller-policy bypass through the Agent Workflow tool, incorrect authorization permitting cross-project deletion of workflows and credentials via Source Control push, and a Git node file-sandbox escape via a relative remote URL.
Patched versions and what you need to do
n8n has shipped fixes across all three of its release lines: the v1 line is patched in v1.123.76, the beta line in v2.38.2, and the stable line in v2.37.7.
n8n Cloud instances are patched automatically, so cloud users have nothing to do. If you’re running a self-hosted instance below these patched versions, update as soon as possible. The two code-execution advisories make this worth treating as a priority rather than routine housekeeping. You can check your running version from the n8n interface (usually shown in the footer or under Settings) or by inspecting the image tag of your Docker container.
For instructions on updating your instance safely, see n8n’s official updating guide. Full technical details for each advisory, including affected versions and remediation notes, are published on the n8n GitHub security advisories page.