On October 14, 2026 n8n, the tool that connects apps and services through automated flows, released security fixes. If you host it on your own server you need to update: version 1.123.85 for the 1.x line, 2.43.5 for stable 2.x, 2.44.1 for the beta. With n8n Cloud, according to noted.lol, the provider took care of it.
Do you have an automation that sends confirmation emails, sorts incoming contacts, updates the customer sheet? Did you set it up a couple of years ago with a friend's help? Good. Now an uncomfortable question: who updates it?
What happened to n8n on October 14?
According to noted.lol, that day n8n published a bulletin with several security advisories: eight described, five of them high severity. The count differs by source, since nex-automations lists fifteen, four of them high severity. The fixed versions match in both.
Among the issues listed by noted.lol are a script injected into a page (called stored XSS), access to other projects' data and exposed credentials. The same article reports no confirmed attacks in the wild.
One useful note: n8n's official release notes confirm version 2.43.5 dated October 14, but list only a change about Gemini models. For the details of the advisories, open n8n's security page on GitHub.
How do I know if this affects me?
- You use n8n Cloud: according to noted.lol, cloud instances were updated automatically.
- Someone (a supplier, a freelancer, the cousin who "does websites") installed it on a server: it affects you. Ask whoever set it up which version is running.
- Several people create or edit flows: according to noted.lol those are the most exposed installations.
What do I do, and in what order?
- Make a copy of your flows and data before touching anything.
- Move n8n to the fixed version for your line or to a newer one. With Docker (the system that packs a program into a container) you update the image and recreate the container, leaving the data where it is.
- Test the main flows: a contact form, a test order, a confirmation email.
- Check who has access and remove accounts that are no longer needed. This is our own tip, useful in any case.
When can I skip worrying?
If you don't use n8n, if you use the Cloud version or if your automations live on another platform, these fixes do not touch you. Every platform has its own advisories, so the question "who reads them?" holds everywhere.
Hypothetical example: a three-person firm has n8n on a small rented server, installed two years ago. Nobody remembers the login. The day a bulletin like this comes out, they find that maintenance was a job with no owner.
Why do automations on your own server need maintenance?
An automation often holds the keys to your email, management software and spreadsheets. If the door opens, the rest opens too. Hosting it yourself costs less, but the maintenance becomes yours. According to Particula, between August 15 and September 30 the n8n repository published 58 security advisories: frequent updates are the norm.
If you want to see how to start without making life hard, read What Is Business Automation? A Guide to Start Small. On the automations and AI page you can see the two options from Sarabi.Cloud: turnkey, meaning built, tested and handed over with documentation, or managed over time.
Frequently asked questions
Do I need to update right away? If your instance is on your own server, yes: data copy first, then the update.
How do I find out which version I use? Ask whoever manages the server. If nobody knows, that is already the important answer.
Does switching platform solve it? Every platform publishes fixes. Only who takes care of them changes.
Want an opinion on your automations? Write to info@sarabi.cloud and tell us in two lines which automations you have, where they run and who updates them.
Sources: noted.lol, nex-automations, n8n release notes, Particula
Have a similar case or a doubt? Write to us at info@sarabi.cloud.