n8n's latest security fixes landed on September 16, 2026. Sixteen vulnerabilities patched, 12 rated high severity, four medium. One of them lets an unauthenticated user pull another person's conversation out of n8n's MongoDB chat-memory node. If you self-host and you're running a chatbot on that node, this one's for you. Cloud instances are already patched. Self-hosted instances below the fixed versions are not.
What do these n8n security fixes actually cover?#
Sixteen vulnerabilities, twelve rated high, four medium, disclosed on n8n's own security-advisories forum. No CVE numbers this round, just GitHub Security Advisory IDs. That's normal for how n8n discloses these.
A few worth naming. Duplicate node IDs could bypass the workflow credential tamper guard, exposing credentials to anyone else editing a shared workflow. An Oracle Database node's delete-table operation was vulnerable to SQL injection. A path traversal bug in signed resume URLs could let one project forge another's approval.
Patched versions, by track:
- v1: 1.123.80
- Beta: 2.40.1
- Stable: 2.39.6
The one I'd actually worry about#
The MongoDB Chat Memory node had a NoSQL injection bug that let an unauthenticated request read another user's chat history across sessions. Not a config mistake. A bug in the node itself.
At WebEpex we build WhatsApp and chatbot automations on n8n for clients across the GCC and Europe, and the day this advisory posted I went through our instance list checking which builds touch that Mongo memory node. If yours does the same thing with Mongo-backed memory, stop reading and go check your version first.
Does this affect you if you're on n8n Cloud?#
If you're on n8n Cloud, you're fine. n8n patches cloud instances directly, no action needed on your end. This is a self-hosted problem.
If you're self-hosted and none of your workflows touch community packages, Oracle, MongoDB memory, or the approval/resume flow, your exposure is lower this round. Lower isn't zero, though. Upgrade anyway. The next advisory might hit a node you actually use.
Is running your own n8n instance still worth it?#
Here's the honest trade-off. Self-hosting saves the per-execution cloud pricing and keeps client data on infrastructure you control, which matters for GCC and European clients with data-residency asks. That part's real.
The part nobody mentions upfront is the maintenance tax. This is the third n8n security advisory we've tracked in 2026. One in January. One on September 2. Now this one. Self-hosting isn't a one-time setup. It's a standing job, and if nobody owns it, patches sit unapplied for months.
How we're handling it at WebEpex#
At WebEpex we run every client automation, WhatsApp bots, lead routing, chatbot flows, on self-hosted n8n behind our own VPS, PM2, and Nginx for clients across the GCC, Europe, and the USA. We didn't move this fast on the January advisory. That one sat for the better part of a week because nobody specific owned watching for it, which was our mistake to fix, not n8n's. This time was different.
Two client builds turned out to touch the MongoDB memory node. Those got patched first, same day we spotted it. The rest followed within 48 hours, tested on staging before we touched anything live. Fix what's actually exposed first, then work down the list. That's the whole method.
This is the same discipline we apply to our own email infrastructure. Self-hosted only pays off if someone treats patching as a recurring job, not a one-off. It's also why we watch who gets standing access to a client's automation stack as closely as we watch the software itself.
What I'd tell a client asking about this#
Check your version this week. If you're below 1.123.80 on the v1 track, upgrade. It takes minutes, and n8n hasn't broken workflows on a patch release yet in my experience. If you don't know which n8n nodes your automations actually touch, whether that's Mongo memory, Oracle, or a community package someone installed two years ago and forgot about, that's the real gap, and it's worth an hour of someone's time to map it once.
If you're not self-hosting and you're on n8n Cloud, you can genuinely stop reading here. This one's already handled for you.
If you're trying to work out whether your own n8n setup has gaps like this sitting unpatched, send me what you're running and I'll tell you straight. Takes two minutes and you don't have to buy anything. cal.com/webepex/growth-review
