Is n8n 2.45.4 affected?

CVSS 8.7

12 known vulnerabilities affect 2.45.4 (highest CVSS 8.7).

1 newer release in its track, up to 2.45.5. What changed up to 2.45.5

Vulnerabilities affecting 2.45.4

8.7
GHSA-9p7v-45m2-wxgj Deprecated Code Nodes Allow Code Execution in the n8n Main Process fixed in 3.0.1
7.7
GHSA-gx3v-3x3v-f8r5 Insufficient Isolation in Workflow Expression Evaluation fixed in 2.45.5
7.7
GHSA-f2cw-9483-7vcp Insecure GraphicsMagick Configuration fixed in 2.45.5
6.3
GHSA-jmcg-c7p5-q69g NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments fixed in 2.45.5
6.3
GHSA-prmc-fg87-r4gh Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects fixed in 2.45.5
6.3
GHSA-mx4r-96jx-v278 Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret fixed in 3.0.1
6.3
GHSA-pwj5-wwm6-g83j Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests fixed in 2.45.5
6.0
GHSA-9qx8-fhxv-w794 Browser Use Upload Tool Reads Arbitrary Files from the n8n Server fixed in 2.45.5
5.3
GHSA-4v22-g448-h4rg MongoDB Node Update Operations Can Modify Unintended Documents fixed in 2.45.5
5.1
GHSA-rc3w-8jc8-7x3w Open Redirect via MCP OAuth Dynamic Client Registration fixed in 2.45.5
4.9
GHSA-2x68-96jw-5r6c SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node fixed in 3.0.1
4.8
GHSA-426f-xmcv-g8pg OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback fixed in 2.45.5

Oct 28, 2026