> ## Content Index
> Fetch the complete content index at: https://wealthlab.life/llms.txt
> Use this file to discover other available public pages before exploring further.

# n8n's October 28 Security Batch: Map Exposure Before You Patch
- URL: https://wealthlab.life/n8n-october-28-2026-security-risk-map/
- Published: 2026-10-29T00:12:07.000Z
- Updated: 2026-10-30T00:11:55.000Z
- Description: n8n published 12 advisories spanning code execution, credential leakage, public endpoints, and data integrity. Here is how to prioritize exposure.
- Author: WealthLab
- Tags: n8n, Security, Self Hosting

**Quick answer:** n8n’s October 28, 2026 security release is not one uniform emergency. Its 12 advisories describe four different exposure paths: code crossing an execution boundary, credentials leaving their intended origin, unauthenticated access to public endpoints, and untrusted input altering data operations. Self-hosted teams should first identify which features are active, then move to a fixed patch for their branch. The vendor bulletin lists **1.123.89**, **2.45.5**, **2.46.1**, and **3.0.1** as security releases; individual advisories have narrower affected ranges and must be checked before drawing conclusions about a specific instance.

*This is a source-based impact analysis published October 29, 2026\. WealthLab reviewed the n8n Security Team bulletin, the 12 maintainer advisories, release pages, and update documentation. We did not run exploit code, test the issues against an n8n instance, or investigate a production environment. This article contains no affiliate links.*

## A patch batch with four different risk shapes

The headline number—12 advisories—does not reveal where practical exposure sits. A private, single-user n8n instance with Browser Use disabled has a different risk profile from a multi-user instance that accepts public webhooks, runs untrusted image transformations, or lets expressions influence database queries.

The useful first question is therefore not “How many advisories apply?” but “Which trust boundary does this deployment cross?” The table below condenses the maintainer descriptions without treating advisory titles as proof of exploitation.

| Exposure path                  | Relevant advisories                                                                         | Precondition that changes priority                                                            |
| ------------------------------ | ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| Execution boundary             | Deprecated Code nodes; expression isolation; GraphicsMagick configuration                   | Untrusted workflow editors, expressions, or images reach the affected feature                 |
| Credential flow                | Browser Use file upload; OAuth callback binding; cross-origin redirects; NocoDB attachments | A member, redirect, attachment URL, or remote browser can influence where secrets or files go |
| Public endpoints               | Embedded Chat authentication; MCP OAuth redirect; Asana webhook secret reset                | The endpoint is reachable and the affected mode or trigger is enabled                         |
| Data integrity and query scope | MongoDB update key handling; OracleDB vector metadata filter                                | External input reaches an update key or metadata-filter name                                  |

## Execution risks are about who can supply code or content

Three advisories concern execution boundaries, but their entry conditions differ. The deprecated Function, Function Item, and LangChain Code nodes could run user-supplied code outside the task-runner isolation applied to the current Code node. The patch blocks adding or modifying those deprecated nodes by default; already saved workflows can continue to run. That detail makes workflow inventory part of the upgrade, not an optional follow-up.

A separate expression-evaluation issue allowed an authenticated user with workflow editing rights to escape expression isolation and execute code on the host. This makes role assignment relevant: an internet-exposed login page is not the same as an untrusted account that can edit workflows, but a shared instance should not assume every member is equivalent to a host administrator.

The GraphicsMagick advisory has another shape. The official Docker image’s bundled image-processing components could allow code execution when an affected Edit Image node processes untrusted images. A webhook-to-image workflow is consequently more urgent than an instance that never uses the node. The maintainer’s temporary guidance includes deactivating those paths, restricting ingress, or excluding the Edit Image node when an immediate upgrade is impossible.

## Credential incidents may begin as ordinary workflow behavior

Four advisories show why secret scope is broader than the credential store itself.

- **Browser Use:** when explicitly enabled, its upload tool accepted absolute paths that Playwright resolved on the n8n server. A member controlling a remote browser session could retrieve files readable by the n8n process. Instances where `N8N_INSTANCE_AI_BROWSER_USE_ENABLED` is unset or false do not meet that advisory’s stated feature precondition.
- **Enterprise OAuth connect flow:** the dynamic credential callback was not bound to the user session that initiated it. Under the advisory’s conditions, another person’s provider tokens could be stored under the initiating member’s identity. The maintainer identifies resolvable OAuth2 credentials on Enterprise instances as the affected configuration.
- **Cross-origin redirects:** credential-using nodes other than HTTP Request v4.4 could forward authorization material after a request redirected to another origin. Risk depends on whether untrusted data can influence the request URL or redirect destination.
- **NocoDB attachments:** with “Download Attachments” enabled, an attachment URL stored in a row could point to an attacker-chosen host, causing the configured NocoDB token to be sent there.

These are reasons to map outbound requests and credential consumers, not reasons to rotate every credential blindly. Rotation becomes justified when a vulnerable path was active, an untrusted party could influence it, or logs show an unexpected destination. A rushed rotation that leaves automation using old secrets can create an outage without answering whether exposure occurred.

## Public endpoint flaws have sharply defined conditions

The Embedded Chat advisory applies to a published Chat Trigger configured for embedded chat with n8n User Auth. The setup route’s authentication exemption could let an unauthenticated request read a named session’s conversation history or trigger the workflow with supplied input. Hosted-chat mode and unrelated webhook workflows should not be conflated with that exact condition.

The MCP OAuth issue turned unauthenticated registration and authorization endpoints into an open redirect. The advisory states that no tokens or session data were included in the redirect and that a victim had to open a crafted URL. That is still useful for phishing and trust abuse, but it is not the same as an OAuth token leak.

The Asana Trigger issue allowed a request carrying `X-Hook-Secret` to replace the webhook verification secret. An attacker who knew the webhook URL could then send forged events while genuine Asana deliveries failed. The fixed range for this advisory differs from the bundle-wide minima: the maintainer lists 2.38.0 and 3.0.1\. This is one example of why the individual advisory—not the bulletin headline—must decide whether a version is affected.

## Database advisories depend on where input becomes structure

The MongoDB node’s Update and Find And Replace operations did not sufficiently validate the update-key value taken from an incoming item. If a workflow sent untrusted webhook input into that field, a caller could match and overwrite unintended documents or insert new ones.

The OracleDB Vector Store issue allowed SQL injection through a metadata-filter key. The stated impact is data readable through the configured Oracle credential when untrusted input reaches the filter key. Both advisories reinforce the same design rule: values from a webhook should not become database identifiers, filter names, or update keys without an explicit allowlist. Patching the known implementation flaw does not remove the need to validate that boundary.

## How to choose the next action without flattening the risks

1. **Record the running branch and exact image.** Do not infer it from a Compose file alone. Capture the version reported by the running n8n process and the immutable image digest where available.
2. **Inventory only the implicated features.** Search active and saved workflows for deprecated code nodes, Edit Image, Browser Use, embedded Chat Trigger with n8n User Auth, Asana Trigger, NocoDB attachment downloads, MongoDB updates, and OracleDB vector metadata filters. Review Enterprise dynamic credentials and outbound redirect behavior separately.
3. **Choose a current fixed patch in the existing branch.** The October 28 bulletin names four security releases, but it is not a reason to downgrade or switch from stable to beta. Read release notes across the actual upgrade path.
4. **Back up recoverable state.** Include the database, encryption-key material, persisted files or binary storage, non-secret configuration, and worker topology. Verify that archives and database dumps are readable before maintenance.
5. **Deploy all n8n processes coherently.** Main, webhook, worker, and task-runner components should not be left on an accidental mix of versions. Inspect startup, migration, queue, and credential-decryption results.
6. **Test affected workflow classes.** Use controlled inputs and non-production destinations. Confirm login, schedules, webhook authentication, queue processing, image handling if used, database update scope, and outbound allowlists.
7. **Investigate where preconditions were present.** Look for unexpected outbound hosts, Browser Use activity, altered webhook secrets, unusual chat sessions, database changes outside expected keys, and deprecated-node edits. Absence of a log entry is not proof of absence when retention was limited.

## Temporary containment when patching must wait

Maintainer workarounds are advisory-specific. Examples include disabling Browser Use; excluding deprecated code or Edit Image nodes; deactivating affected Chat, Asana, MongoDB, OracleDB, or NocoDB workflows; binding OAuth callbacks; restricting editor roles; blocking MCP OAuth endpoints at a trusted reverse proxy; enabling SSRF protection; and constraining outbound network access.

None of those controls is a universal substitute for the fixed release. They are most useful when tied to an identified feature and a short maintenance window. A broad ingress block can also interrupt legitimate webhooks, while a broad egress block can break API integrations, so containment needs an explicit rollback and acceptance test.

## What this release does—and does not—establish

The advisories establish maintained descriptions, affected ranges, patches, and temporary mitigations. They do not establish that every vulnerable deployment was compromised, that every public n8n instance is exploitable, or that upgrading erases historical evidence. GitHub’s advisory API showed no CVE identifier for these 12 records during this review, and we found no independent technical reproduction suitable for adding exploit claims. The analysis therefore stays within the maintainer-published scope.

n8n Cloud customers are described by the bulletin as automatically updated. Self-hosted teams remain responsible for selecting and validating their release. If a deployment handled untrusted files, redirects, webhook data, or member-created workflows before patching, version remediation and retrospective review are separate jobs.

## Related WealthLab guides

- [n8n October 14 Security Update: Self-Hosted Patch Checklist](https://wealthlab.life/n8n-security-update-october-2026/)
- [n8n 3.0 Upgrade Checklist for Self-Hosted Instances](https://wealthlab.life/n8n-3-upgrade-checklist/)
- [n8n VPS Requirements: RAM, CPU & Docker Sizing](https://wealthlab.life/n8n-vps-requirements/)
- [VPS Firewall Setup for Docker Apps](https://wealthlab.life/vps-firewall-docker-apps/)

## Sources checked October 29, 2026

- [n8n Security Team: Security update—28 October 2026](https://community.n8n.io/t/security-update-28-october-2026/325135) — primary source for the 12-advisory bundle and branch release list.
- [GHSA-9p7v-45m2-wxgj: deprecated Code nodes](https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj); [GHSA-gx3v-3x3v-f8r5: expression isolation](https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5); [GHSA-f2cw-9483-7vcp: GraphicsMagick](https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp).
- [GHSA-9qx8-fhxv-w794: Browser Use file access](https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794); [GHSA-426f-xmcv-g8pg: OAuth callback binding](https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg); [GHSA-prmc-fg87-r4gh: credential redirects](https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh); [GHSA-jmcg-c7p5-q69g: NocoDB attachments](https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g).
- [GHSA-pwj5-wwm6-g83j: Embedded Chat auth](https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j); [GHSA-rc3w-8jc8-7x3w: MCP OAuth redirect](https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w); [GHSA-mx4r-96jx-v278: Asana Trigger](https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278).
- [GHSA-4v22-g448-h4rg: MongoDB update operations](https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg); [GHSA-2x68-96jw-5r6c: OracleDB vector metadata filter](https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c).
- [n8n documentation: Update n8n](https://docs.n8n.io/hosting/installation/updating/) — maintained update and release-channel guidance.
- [n8n 3.0.1 release](https://github.com/n8n-io/n8n/releases/tag/n8n%403.0.1) and [n8n 2.45.5 release](https://github.com/n8n-io/n8n/releases/tag/n8n%402.45.5) — release records for two named fixed builds.