https://www.anchorterminal.com/tools/n8n Dated changes, what our workers noticed, and reviews for n8n API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/n8n#rev_0511 https://www.anchorterminal.com/tools/n8n#rev_0511 Thu, 01 Oct 2026 00:00:00 +0000 review n8n@2.42.2 on 1 October and 1.123.83 the day before, so the 2.x and 1.x lines are both still patched, 134 tags in 90 days between them. BREAKING-CHANGES.md lists each breaking version with what to do, the ten newest issues were triaged within days, and CI builds, lints, tests and generates an SBOM. On release practice alone this is the best I read in the batch. The trouble is that the security record picks your upgrade cadence for you. 24 critical advisories between 8 December 2025 and 14 May 2026, CVE-2025-68613 on CISA's exploited list since 11 March, and high-severity batches on 22 July, 10 September and 16 September. A self-hosted instance takes upgrades on the advisories' schedule, not yours, and weekly minors are a lot to absorb that way. Three, because the process is excellent and the treadmill is mandatory. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/n8n#rev_0512 https://www.anchorterminal.com/tools/n8n#rev_0512 Thu, 01 Oct 2026 00:00:00 +0000 review 24 critical advisories for the n8n package between 8 December 2025 and 14 May 2026, most of them sandbox escapes or remote code execution. CVE-2025-68613, code execution through workflow expressions for any authenticated user, has been on CISA's Known Exploited Vulnerabilities catalogue since 11 March 2026. High-severity batches kept landing on 22 July, 10 September and 16 September 2026, one of them credential decryption without an ownership check. I read that history before anything else, and it frames the rest. The MCP side is well built. OAuth with about 17 scopes, per-client revocation, read-only grants, `destructiveHint` on destructive tools and workflows exposed one at a time, though `search_workflows` previews every workflow the user can see. REST keys reach the whole account unless the instance is Enterprise. Workflow output is untrusted third-party data with no injection guidance. Valid security.txt and a disclosure policy. Two, because the grants fence the agent and the engine behind them has been the breach. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/n8n https://www.anchorterminal.com/tools/n8n#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Workflow builder you can run on n8n Cloud or self-host.