Security Advisory: Critical vulnerability in n8n Versions 1.65-1.120.4
The RSS signal today is a security advisory from n8n detailing a critical vulnerability affecting self-hosted n8n installations. The flaw concerns certain form-based workflows and, under specific conditions, could allow an unauthenticated remote attacker to access information or compromise the underlying file system. The vulnerability has been fixed in n8n version 1.121.0 (released November 18, 2025), and a patch is now required for any self-hosted instances still on affected versions. Cloud deployments have already been upgraded automatically within 12 hours of the advisory.
What happened
An identified vulnerability affects form-based workflows that include a Form Submission trigger accepting a file element and a Form Ending node returning a binary file. The issue stems from improper input validation, which could be exploited to grant read access to the server’s filesystem under particular circumstances. In practical terms for a No‑Code operation, this means a flawed workflow could unintentionally expose sensitive files or grant an attacker the ability to read local or mounted storage used by automation pipelines.
Affected versions and fix
- Affected: n8n versions 1.65 through 1.120.4 (self-hosted deployments).
- Fixed in: n8n version 1.121.0 (released November 18, 2025) and later.
- 2.x versions: No action needed — you are already on a version with the fix.
- Cloud deployments: Automatically upgraded within the next 12 hours following the advisory.
Impact on No-Code automation and business operations
Why this matters to no-code business owners and operators who rely on n8n for automation:
- Attack surface on live automations: Form-based triggers are common entry points for customer-facing data collection and internal workflows. A vulnerability here can create an entry point for attackers to access protected assets.
- Data exposure risk: Exposed filesystem data could include configuration, credentials, customer data, or workflow artifacts stored in local or mounted storage used by the automation platform.
- Regulatory and governance impact: For regulated industries, exposed logs or data from automations may trigger compliance concerns and require forensic review.
- Business continuity considerations: A compromised n8n instance could disrupt automated processes, affecting lead routing, CRM updates, notification flows, and reporting dashboards.
- Cloud vs. self-hosted dynamics: Cloud deployments won’t face the same patch cycle as self-hosted instances, as the vendor manages updates. Self-hosted users must actively upgrade to minimize risk and may need to validate other connected services for vulnerabilities introduced by the compromise.
Mitigation and upgrade path
Recommended actions to restore and safeguard automation environments:
- Move to n8n 1.121.0 or later if you’re on 1.65–1.120.4. This patch contains the necessary fixes to close the vulnerability.
- You’re already on a version with the fix; no action required.
- Expect automatic upgrades within 12 hours; verify post-upgrade residual issues are resolved.
- Use the workflow template referenced in the advisory to scan your self-hosted instance for potentially vulnerable workflows. This helps identify any flows that need remedial rework or supplemental security controls.
- In the short term, consider temporarily disabling or auditing form submission flows that process sensitive files until patching is complete. Review workflows that handle binary content and uploaded attachments.
- As a precaution, rotate credentials used by workflows and ensure secrets are stored in a proper vault or secret store rather than hard-coded in workflows.
- Validate inputs at the Form Submission trigger, enforce strict access controls, enable environment segmentation, and ensure Form Ending nodes that return binaries are protected with appropriate permissions.
Operational guidance for No-Code owners
Below is practical guidance tailored for business owners and automation teams relying on n8n:
- Schedule a maintenance window to upgrade and test critical automations. Prioritise flows touching file uploads, attachments, or any binary data processing.
- If you have a staging environment, validate common workflows—especially those handling customer documents and invoices—before upgrading production.
- Post-upgrade, monitor execution logs and system health to detect anomalies early. Consider enabling or validating guardrails, input validation, and error-handling workflows to catch any post-patch issues.
- Reconcile any potential exposure with data retention policies, access control reviews, and audit logs. Ensure sensitive data isn’t exposed through misconfigured form-based triggers post-patch.
What this means for the No-Code ecosystem
The immediate signal is clear: security-first automation is non-negotiable. For No-Code creators and automation shops, the advisory reinforces a few crucial themes:
- Patch discipline is a competitive advantage: Prompt patching reduces risk and demonstrates governance maturity to clients and stakeholders.
- Security-conscious design pays off: Designing workflows with input validation, least-privilege access, and secure storage becomes a differentiator in client engagements.
- Dynamic risk management is part of product strategy: Partnerships and agencies should embed vulnerability management into their go-to-market playbooks and client onboarding checklists.
- Automation reliability must be measurable: As patches roll out, teams should monitor for regression and maintain a robust evaluation approach to ensure stability post-upgrade.
Verification and next steps
This advisory stands as a concrete signal to revisit security practices around form-based automation and to establish a resilient upgrade cadence. The No-Code ecosystem depends on dependable platforms; staying aligned with security advisories is an essential part of maintaining client trust and operational continuity.
Appendix: quick upgrade checklist
- Confirm your current n8n version and whether any form-based workflows could be affected
- Plan and schedule the upgrade to 1.121.0+ for self-hosted instances; coordinate with cloud provider’s patch cycle
- Run the advisory’s recommended vulnerability scan workflow to identify any at-risk configurations
- Review and secure form-based triggers that handle binary content; apply any recommended hardening measures
- Rotate secrets and validate instrumented security controls post-upgrade
- Audit and report on the upgrade across production workflows to confirm no regressions
Closing takeaway
Today’s signal underscores a fundamental reality for No-Code automation: security must be integrated into the backbone of automation strategy, not treated as an afterthought. The recommended upgrade to 1.121.0+ is not just a patch; it is a reinforcement of trust in automated processes that power customer engagements, internal operations, and critical business decisions.