N8n critical security issue and how to update

Admin Talk
1

Hello,

two CVE with a 10/10 score have been released and the current n8n version that is deployed with our seatable install was at risk.

the docker compose file fixes a specific old and risky version of n8n.
we do not use n8n but it’s activated by default. I don’t know if the latest n8n version is working well with seatable and have no time to give a try.

What I’ve done :

  • BACKUP !
  • navigate to /opt/seatable-compose
  • nano n8n.yml
  • replace the n8n image tag as image: n8nio/n8n:latest
  • docker compose down n8n
  • IMPORTANT : you need to allow a specific db function : pgcrypto for migration to work :
    docker exec -it n8n-postgres psql -U root -d n8n -c “CREATE EXTENSION IF NOT EXISTS pgcrypto;”
  • docker compose pull n8n

  • docker compose restart n8n

If you are a n8n user and give a update try, please do a feedback to mention if your scripts are still operational.

1 Like
2

@Ben is absolutely right. Some critical security vulnerabilities have been discovered in n8n:
Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control.

While most of the reported issues require authentication, one in particular allows unauthenticated attackers to fully compromise an instance , which makes it especially severe.

In addition to @Ben’s recommendations, I suggest first upgrading to the latest 1.x release (v1.123.10 ). Then, open the Compatibility Report (n8n → Settings → Migration Report) to ensure your setup is ready for the major version jump.

Here is how it should look like:

n8n-upgrade
n8n-upgrade753×418 25.1 KB

Once everything checks out, proceed with the upgrade to either the latest version or 2.2.3 (current stable).

1 Like
3

Please make sure you check the Instance Issues too because they can also break stuff if you ignore them. This is something that could be updated in the compose file. :wink:

4

I just scanned the whole issue (especially their migration guide), and have seen this: n8n v2.0 breaking changes | n8n Docs

Remove task runner from n8nio/n8n docker image

Starting with v2.0, the main n8nio/n8n Docker image will no longer include the task runner for external mode. You must use the separate n8nio/runners Docker image to run task runners in external mode.

Migration path: If you run task runners in Docker with external mode, update your setup to use the n8nio/runners image instead of n8nio/n8n.

@cdb Since I see N8N_RUNNERS_ENABLED=true in seatable-release/compose/n8n.yml at main · seatable/seatable-release · GitHub , does that mean we should switch to the n8nio/runners image?

Or, to be more precise: Are internal runners still in the image? What to you recommend?

5

I just did the 2.x update - regarding my question, there seems to be only internal JS runners in the image now. It seems as if Python runners need to run in an external container. We don’t use Phython runners in code nodes (yet), no problem.

6

I will update our seatable release within the next days.

1 Like