n8n fixes 16 flaws, two reaching code execution

n8n published 16 security advisories on September 12, and two of them reach code execution. Anyone self-hosting a version before 1.123.76, 2.37.7 or 2.38.2 is running an instance where a workflow expression can execute arbitrary code on the server. The other fourteen advisories in the batch fix access-control gaps in approval flows, OAuth consent, and session handling.

CVE-2026-86083 works by having a workflow expression override the global JSON.stringify function. The legacy expression engine calls its own code generator during evaluation. That generator ends up emitting the attacker's replacement code instead of the JSON output it expected.

CVE-2026-86076 takes a different path. It rebinds a class-field sanitizer so the expression can reach JavaScript's Function constructor directly.

Both are fixed in 1.123.76, 2.37.7 and 2.38.2. Anyone who can't upgrade immediately has a stopgap. Setting N8N_EXPRESSION_ENGINE=vm turns off the legacy engine both bugs depend on.

An approval gate can be bypassed anonymously by reusing a resumeToken over the chat WebSocket. OAuth consent can also be skipped on a per-resource basis, letting a connected integration through without the prompt n8n is supposed to show.

Project members' personal data is exposed across tenants that shouldn't see each other. Disabled OIDC SSO endpoints keep issuing valid sessions even after an admin turns SSO off, per n8n's security advisory.