n8n 2.34.0 propagates sub-agent tool approvals and closes an editor postMessage origin hole
Released 2026-08-04, n8n 2.34.0 fixes sub-agent tool approvals failing to propagate, which had let nested agent calls bypass the human-in-the-loop gate that the parent workflow established. Security fixes include a configurable origin allowlist for editor postMessage handling and returning 405 for GET requests against the instance MCP endpoint. Operationally it adds OTel spans for queue-mode executions, recovers enqueued executions after a restart, improves task-broker resilience when a runner dies, limits the size of webhook responses relayed through the queue, and routes crash-loop auto-deactivation through the normal workflow unpublish flow. This matters because n8n currently carries more agentic-AI security advisories than any other project in the category.
↳ Follow the thread