n8n fixes nested-agent bypass of human approval gates

n8n shipped version 2.34.0, fixing a bug that let sub-agent tool calls bypass the human-approval gate a parent workflow had set, per GitHub's release notes.

The project already carries more agentic-AI security advisories than any other in the category. A hole in how approval propagates through nested agents lands on a platform where builders already chain real automation.

When a workflow nested another agent inside it, the approval step wasn't propagating down. The sub-agent could call tools the top-level workflow never cleared.

This release also adds a configurable origin allowlist for the editor's postMessage handling, per the release notes. That closes off a path for untrusted pages to reach the n8n interface. It also fixes the instance's MCP endpoint, returning a 405 on GET requests instead of processing them.

Update before you trust the approval step

If you're running approval-gated workflows in n8n with any sub-agent calls, don't assume anything before 2.34.0 enforced what you configured. Update to 2.34.0 and check every workflow where an agent calls another agent.

n8n's advisory lead in this category is a byproduct of how many builders route real agent chains through it. It's not proof the code is weaker than competitors'. That holds up only if the next nested-agent bug doesn't look like this one.