What to do now
On 30 September, n8n published a new batch of security advisories, most rated high severity. If you self-host n8n, do this now:
- Check the version shown in your n8n instance.
- If you remain on the 1.x line, update to 1.123.83 or later.
- On the 2.41 line, update to 2.41.4 or later. On the 2.42 line, use 2.42.1 or later.
- Back up the database and encryption key before the update, then test public webhooks, chat triggers and approval workflows.
- Until the update is complete, restrict access to trusted users and disable public or shared workflows you do not need.
Those version floors come from the individual n8n advisories. The Git-node code-execution advisory, for example, lists 1.123.83, 2.41.4 and 2.42.1 as patched releases. The MCP account-takeover advisory lists 2.41.4 and 2.42.1.
Why this update should not wait
This is not one narrow defect. The new advisories cover several different paths: code execution through the Git node, an MCP permission bypass that can lead to an owner-account takeover, SQL injection through the Microsoft SQL node, forged approvals in Send-and-Wait workflows, and session theft through chat or file previews.
Not every instance exposes every path. A single-user installation without the affected nodes has less exposure than a shared instance with public triggers. But several advisories explicitly say their temporary workarounds do not fully remove the risk. That makes upgrading the practical answer rather than trying to judge each workflow from a distance.
If you cannot update immediately
Reduce the exposed surface until you can. Disable the instance-level MCP server when unused, exclude the Git node when unused, require authentication for hosted chat, and pause public triggers that lead into Send-and-Wait approvals. Do not open binary previews produced by an untrusted member. These measures come from the MCP, Git, chat, approval and file-preview advisories.
These are stopgaps, not substitutes for the patched release. If someone else operates your n8n instance, send them the advisory list and ask them to confirm the installed version.