Security Advisory: Vulnerability in n8n Versions 1.65-1.120.4 Fixed in 1.121.0; Self-hosted Upgrade Required; Cloud Upgrades in Place
The RSS signal today centers on a critical n8n security advisory detailing a vulnerability that could allow an unauthenticated remote attacker access to sensitive information on the server. The vulnerability affects form-based workflows specifically, requiring a form submission trigger that accepts a file element and a form ending node returning a binary file. The vulnerability was fixed in n8n version 1.121.0 and has been deployed to all cloud customers. Self-hosted users must upgrade to 1.121.0 (or later) as soon as possible.
Lead signal: what happened and why it matters
On November 18, 2025, n8n released version 1.121.0 to address a critical security vulnerability that affected self-hosted installations running versions 1.65 through 1.120.4. According to the official advisory, the vulnerability could be exploited by an unauthenticated attacker who can access a form submission workflow that includes a file input and a Form Ending node that returns a binary file. The result could be unauthorized read access to files stored on the system and, depending on deployment, potential privilege escalation. Cloud instances were upgraded automatically to the patched version, mitigating risk for customers who rely on the hosted service.
Who is affected and why this matters for No‑Code businesses
- Affected users: Self-hosted n8n installations running 1.65–1.120.4 with active workflows that include a Form Submission trigger accepting a file element and a Form Ending node returning a binary file.
- Unaffected versions: Any 2.x release or 1.121.0+ are not affected; cloud customers have already been upgraded.
- Operational impact for automation shops: If you operate data pipelines, document processing, or customer-upload workflows, you must upgrade promptly to prevent potential unauthorized data access. Unpatched systems can expose sensitive files and configuration secrets, undermine audit trails, and erode client trust during incident investigations.
The fix and how to apply it
The vulnerability is fixed in n8n version 1.121.0. If you are running self-hosted n8n, upgrade to 1.121.0 (or later) immediately. If you are on a 2.x version, you already have the fix, and cloud customers have been upgraded automatically. The advisory provides a workflow template you can run to scan for potentially vulnerable workflows—a practical, hands-on step to verify your environment after upgrading.
What to do in the next 24-48 hours
- Patch now. Upgrade any self-hosted 1.65–1.120.4 instance to 1.121.0 or newer. Do this in a maintenance window if possible to minimize disruption.
- Scan for exposure. Run the provided workflow to identify potentially vulnerable workflows that contain a Form Submission trigger with a file element and a Form Ending node returning a binary file. Remediate those specific workflows or disable them until re-validated.
- Validate cloud status. If you rely on n8n Cloud, confirm your cloud instance has been upgraded and monitor the status through the cloud dashboard and release notes.
- Audit and monitor. Review access controls, rotate any credentials that flow through form-based data, and ensure sensitive data exposure is minimized during upgrades. Prepare a short incident response plan if a breach is suspected.
Impact on day-to-day operations for No‑Code business owners using n8n
For the typical No‑Code business running automation through n8n, the vulnerability translates into a concrete operational playbook: patch fast, verify, and normalize. Here is how this shift translates into daily tasks and risk management.
- Patch cadence becomes critical: Patch management shifts from a “nice-to-have” to a mandatory practice. For many SMBs, this means setting up a recurring maintenance window and vetting upgrade notes before deployment. The cost of downtime is outweighed by the cost of a potential data breach or unauthorized access.
- Security hygiene standardization: The vulnerability exposes the need for baseline hardening: limited exposure of form endpoints, careful handling of file inputs, and avoidance of storing sensitive files in insecure locations. Review memory management, secrets handling, and access control for all workflows that process files via forms.
- Impact on customer-facing automation: If your workflows collect or store user-uploaded files, this is a high-priority risk. Ensure your file-handling workflows route through server-side validation and that files are stored in a secure location with proper access policies after upgrade.
- Auditability and compliance: For regulated industries (healthcare, finance), an upgrade is part of maintaining compliance. You’ll want to document the upgrade, confirm revised security posture, and update incident response playbooks accordingly.
- Operational risk and testing: The upgrade introduces a potential change in runtime behavior; testing in a staging environment is essential. Validate critical flows in a staging space before pushing to production to avoid unexpected failures.
Verification steps and a practical remediation plan
Below is a practical remediation plan you can implement today, designed for business owners who run n8n automation as a core capability.
- Identify exposure — Inventory workflows that use Form Submission with a file input and a Form Ending node returning a binary file. This is the exact combination the advisory identifies as vulnerable.
- Upgrade — Upgrade all self-hosted instances from 1.65–1.120.4 to 1.121.0 or newer. For cloud deployments, verify upgrade status in your management console.
- Scan post-upgrade — Run the advisory’s recommended workflow to scan your instance for vulnerable workflows and verify that no vulnerable configurations remain. The workflow results should confirm a clean state.
- Test critical flows — In a controlled test environment, simulate a file upload through a Form Submission workflow to ensure the system behaves securely after upgrade and does not leak files or credentials.
- Document and monitor — Update your security runbook to reflect the upgrade, the post-upgrade verification, and any changes to access controls. Set up alerts for any anomalies around form submissions or binary file handling in production after upgrade.
What this means for the No‑Code ecosystem today
Security is a fundamental enabler of trust in the No‑Code ecosystem. This signal reinforces a few important truths:
- Security evolves with automation: As automation apps enable more data handling, the security surface expands. The n8n security advisory is a reminder that automation platforms are not a one-off solution; they require ongoing maintenance and vigilant patching.
- Owners must own patch governance: No‑Code builders are often in a vendor-agnostic environment. The advisory demonstrates that patch governance is an operational capability. A simple, repeatable upgrade procedure reduces downtime and risk significantly.
- Cloud upgrades don’t eliminate risk for self-hosted users: Cloud users see the patch applied automatically, but self-hosted users must actively upgrade. A robust upgrade plan ensures parity in security posture and reduces the chance of delayed patching due to operational concerns.
- Auditing and testing as a discipline: The recommended workflow to scan for vulnerable forms highlights a broader discipline: test, validate, and document every change to critical automation.
Conclusion: turning a security signal into a strategic operational action
The day’s most consequential signal is a reminder that the No‑Code automation space cannot ignore foundational security. The vulnerability in 1.65–1.120.4 is a serious prompt to upgrade, scan, and test. For business owners relying on n8n to automate customer interactions, data processing, and operational workflows, this is a directive rather than a suggestion. It demands disciplined patching, careful validation, and a renewed focus on security hygiene that will pay dividends in reliability and trust. The patch to 1.121.0 is not just a bug fix; it is a guardrail that preserves the integrity of production automation and the confidence of customers who rely on your automated processes.
Technical note: The advisory explicitly notes that 2.x releases already contain the fix, cloud instances are upgraded automatically, and a workflow is provided to detect vulnerable configurations. If you are managing multiple environments, consider a standardized upgrade window and a single source of truth for upgrade status and remediation records.
References
- Security Advisory: Security Vulnerability in n8n Versions 1.65-1.120.4 (1.121.0 fix)” — official n8n advisory
- n8n Cloud upgrade status and migration notes
- Provided workflow template to scan for vulnerable workflows