n8n security advisory (AV26-985)
Canada's Cyber Centre warns n8n builds before 1.123.80, 2.39.6, and 2.40.1 have validation-bypass and token-leak flaws.
On October 1, 2026, the Canadian Centre for Cyber Security published advisory AV26-985 for n8n releases before 1.123.80, 2.39.6, and 2.40.1. The notice covers a community package install validation bypass via PubSub in queue-mode deployments and a dynamic-credentials authorize endpoint that can leak a session token to an attacker-controlled resolver. No exploitation is reported. Administrators are told to review the linked n8n materials and apply updates as they become available.
- Affects n8n before 1.123.80, 2.39.6, and 2.40.1.
- Queue-mode PubSub can bypass community package install validation.
- Dynamic-credentials authorize endpoint may leak a session token to an attacker-controlled resolver.
- Cyber Centre urges administrators to review links and apply updates.
Full article79 words · extracted from cyber.gc.ca · click to collapse
Serial number: AV26-985
Date: October 1, 2026
As of October 1, 2026, n8n is affected by vulnerabilities in the following product:
- n8n
- Prior to 1.123.80
- Prior to 2.39.6
- Prior to 2.40.1
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/n8n-security-advisory-av26-985