n8n patched 18 security vulnerabilities on 2 September 2026, five of them high-severity, including two expression-sandbox escapes that n8n says can lead to code execution. If you're running n8n self-hosted below the fixed versions, this is a this-week problem, not a someday one. If you're on n8n Cloud, you're already patched and this doesn't change anything for you.
What This n8n Security Update Actually Patches#
n8n's own security advisory, posted 2 September 2026, lists 18 fixes: five high-severity, thirteen medium. The five high-severity issues:
- Unauthenticated persistent-storage exhaustion via the OAuth dynamic client registration endpoint
- Expression-sandbox escape via class-field sanitizer rebinding, leading to code execution
- Regex denial-of-service in the default blocked-file-pattern match on the Git node
- Domain-restriction bypass in the OpenAI Chat Model node
- Expression-sandbox escape via shared builtin tampering, also leading to code execution
Thirteen more medium-severity fixes touch OIDC SSO, approval gates, and credential handling. n8n lists those in full in its security advisories category — worth a bookmark if you run this tool.
Does This Affect Your Automations?#
If you're on n8n Cloud, no. n8n patched Cloud instances automatically as part of this release. You can stop reading here if that's your whole setup.
If you're self-hosting — your own VPS, a Docker box, whatever — and running a version below 1.123.76 on the v1 line, 2.38.2 on beta, or 2.37.7 on stable, you're exposed until someone upgrades it manually.
n8n's own language is measured: "we recommend upgrading at your earliest convenience." That reads calmer than the actual risk. Two of the five high-severity bugs are sandbox escapes that lead to code execution. That's not a nuisance bug. That's someone getting a shell on the box running your lead-routing workflows, your WhatsApp automations, your CRM syncs.
I'd treat "at your earliest convenience" as "this week," not "next sprint."
The Trade-off: Patching Cadence vs Self-Hosted Burden#
Credit where it's due. n8n has now published a security advisory roughly every two to three weeks through 2026 — 20 August, then 2 September — and this round shipped fixes across all three release lines at once instead of leaving beta or v1 users waiting on stable.
The honest downside: self-hosted n8n puts the patching burden entirely on you. Cloud handles it silently. Self-hosted doesn't, and plenty of the SMBs and agencies running n8n on a cheap VPS aren't checking a community forum every few weeks for advisories.
We don't know from n8n's post whether any of these five issues were being actively exploited before the fix shipped. The advisory doesn't say, and I'm not going to guess at that. What we do know is the fix exists now, which means the clock on someone reverse-engineering the patch and going looking for unpatched instances has already started.
How We're Handling This at WebEpex#
We build WhatsApp and lead-automation flows for GCC and Indian SMBs on n8n, self-hosted behind PM2 and Nginx rather than on Cloud, so this one landed on our own infrastructure, not just client theory. We pulled the version number off every n8n instance we manage the day the advisory went up and checked each one against 1.123.76 / 2.38.2 / 2.37.7.
Where a client workflow touches the OpenAI Chat Model node — and a fair number of ours do, since that's how we wire model calls into intake and qualification flows — we prioritized that upgrade first. The domain-restriction bypass sits right next to where client data leaves the workflow, which is a worse place for a bug than most.
The expression-sandbox fixes went in across every instance the same day, cloud and self-hosted alike, regardless of whether a given workflow used the affected nodes. Easier to patch everything once than to audit which flows were exposed. It's the same instinct we applied when Meta's WhatsApp API pricing changed on Oct 1 and when GLM-5.3-Flash's pricing jumped — check every affected build first, then decide, rather than wait for something to break.
We're not moving anyone off self-hosted n8n over this. We are adding a version check to our standing maintenance pass instead of treating patching as a reactive, someone-tells-us thing.
What I'd Tell a Client Asking About This#
Check your n8n version this week. If you're self-hosted and below 1.123.76 (v1), 2.38.2 (beta), or 2.37.7 (stable), upgrade — it's a version bump, not a migration. If you're on Cloud, you're covered already and there's nothing to do.
If any workflow uses the OpenAI Chat Model node, look at that one first. And if you genuinely don't know which version you're running, or whether anyone's checking, that's the real problem here. Not this specific patch — the absence of anyone owning it.
If you want a second pair of eyes on your n8n setup, patched or not, send me what you're running and I'll tell you straight, no pitch attached. [cal.com/webepex/growth-review]
