# n8n: update and migrate workflows using deprecated code nodes Canonical: https://www.oktsec.com/radar/n8n-cve-2026-119408 Publisher: Oktsec Language: en Published: 2026-11-03T17:00:17Z Updated: 2026-11-03T17:00:17Z Record reviewed: 2026-11-03T17:00:17Z Latest evidence check: 2026-11-03T17:00:17Z Disclosed: 2026-10-28 Authenticated workflow editors can execute code outside task-runner isolation through deprecated nodes. Patched releases block new or modified uses by default, but saved workflows can continue running. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Workflow editing privileges are required. Updates block new deprecated-node uses, but existing workflows need migration; active exploitation is not established. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Account access required - Vendor: n8n - Products: n8n - CVEs: CVE-2026-119408 ## Technical overview Function, Function Item and LangChain Code nodes expose code execution in the main process. This requires workflow authoring permissions, rather than unauthenticated access. The CNA record explicitly links CVE-2026-119408 to this maintainer advisory, even though GitHub’s CVE field remains empty. Active exploitation is not established by these sources. Treat the rollout as both a software update and a workflow migration. Keep a tested rollback plan that does not re-enable the vulnerable nodes. ## Recommended response Upgrade the applicable branch and replace deprecated nodes in existing workflows. Relevant to: Teams responsible for the affected deployments. ## CVE attribution - CVE-2026-119408: n8n — n8n. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119408.json) ## Affected systems and fixes ### n8n Affected: Before 2.42.6; 2.43.x before 2.43.3; 3.x before 3.0.1. Review saved deprecated-node workflows separately. Fixed release / action: 2.42.6; 2.43.3; 2.44.0; 3.0.1 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.29 Checked: 2026-10-30T10:27:08.428Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-119408 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Update the applicable branch** — Use 2.42.6, 2.43.3, 2.44.0 or 3.0.1, or a later supported release in the applicable branch. 2. **Migrate existing workflows** — Find Function, Function Item and LangChain Code nodes and replace them with Code nodes; test their outputs and permissions. 3. **Keep the default block enabled** — Do not set N8N_DEPRECATED_NODES_BLOCK=false. Existing saved workflows require separate review. 4. **Restrict workflow editing** — Pending migration, limit authors to trusted users. The maintainer lists NODES_EXCLUDE as a temporary mitigation, not complete remediation. ## Relevance to AI environments Include automated workflows in the response inventory; the evidence does not establish AI involvement in the attack. ## Sources - [n8n: deprecated code nodes and migration requirements](https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj) — n8n; Vendor notice; checked 2026-11-03T17:00:17Z - [CNA record: CVE mapping and affected branches](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119408.json) — VulnCheck; Research report; checked 2026-11-03T17:00:17Z ## Editorial record - 2026-11-03T17:00:17Z: Added source scope and a practical response checklist. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/n8n-cve-2026-119408) · [Build a response plan](https://www.oktsec.com/radar/n8n-cve-2026-119408#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=n8n-cve-2026-119408&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=n8n-cve-2026-119408&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.