This is your bi-weekly security update from n8n. The following security advisories have been published since our last update:
- Severity: High | Invitation Acceptance Endpoint Lets a Member Take Over Pending User Accounts — GHSA-m7qq-gm3x-v79g
- Severity: High | Custom Instance Role with User Management Permissions Gives Control of the Owner Account — GHSA-q8rc-7m84-mfvj
- Severity: Medium | Workflow Activation Allows Trigger Nodes to Use Credentials the Publisher Cannot Access — GHSA-h59h-rf6m-7jp5
- Severity: Medium | AWS Bedrock Nodes Skip SSRF Protection for Custom Runtime Endpoints — GHSA-g333-hr44-g82p
- Severity: Medium | Integration Nodes Send Authenticated Requests to Unintended API Endpoints — GHSA-c772-hjfp-gfc2
These vulnerabilities have been fixed in the following n8n versions:
- v1 patched in v1.123.96
- v3 patched in v3.2.2
- beta patched in v2.48.3
- stable patched in v2.47.6
What you need to do
If you are running a cloud version of n8n, your instance is patched automatically, and no action is required.
If you are running a self-hosted n8n instance on a version below the fixed versions listed above, we recommend upgrading at your earliest convenience.
- Upgrade guide: Update n8n | Deploy | n8n Docs
- Full advisory details: Security Advisories · n8n-io/n8n · GitHub
If you are already running the latest patch version for your release branch, no action is needed.
Staying up to date
These updates are part of our regular security communication cadence. If you don’t already, you can also opt in to receive these updates via email here.
Learn more about our security approach: How n8n handles vulnerability disclosure - and why we do it this way – n8n Blog
Best regards,
The n8n Security Team