n8n 發佈 2.46.3、2.45.7 及 1.123.91，穩定版收緊工作流程路由權限

Posted on Oct 31 Edited on Oct 31

📅 31 October 2026 • n8n Release Notes on GitHub

n8n shipped patch releases across its maintained branches on 30 October: 2.46.3 on the beta line, 2.45.7 on stable and 1.123.91 for the legacy 1.x series. The security-relevant change shipped on the stable line: only the 2.45.7 notes list a hardening fix, while the same-day beta and legacy builds are routine maintenance. A patch-note style summary: what changed and why it matters for operators.

The headline change is a permission tightening. The 2.45.7 changelog lists a core fix: Require execution:read when workflow-scoped routes read execution data. In practice, routes scoped to a workflow could return execution data to users whose roles covered workflow scopes but not execution scopes. After the patch, reading execution data through those routes enforces the same execution:read scope the executions API has always applied. A related change merged on 23 October aligns the AI Assistant: it now requires execution:read to read and list executions and to add recent runs to its context, matching the executions API and MCP tools. The change is documented in the release notes, pull request 41863 and merge commit a967486. No GitHub security advisory for this specific change appears in the public advisories listing as of publication. The tab currently lists only unrelated items from the 28 October security update.

Also in this cycle. Release 1.123.90, shipped a day earlier, added a required signed token to accept invitations, closing the door on unsigned invite links. Legacy deployments received the signed invitation-token requirement in 1.123.90 (29 October). The execution:read tightening is not listed in any 1.123.x release so far. n8n publishes such changes through regular GitHub releases and bi-weekly security updates on the community forum, where advisories are listed with GHSA identifiers. Users on all branches should upgrade to the respective patch versions.

IMPACT. Self-hosted operators and platform teams: plan an upgrade to 2.45.7 on stable, where the fix currently ships. After upgrading, audit custom roles and project permissions - roles that grant workflow scopes without execution:read will stop returning execution data on workflow-scoped routes, so dashboards, reports or integrations that relied on that behavior need the execution:read scope added explicitly. Invitations now require signed tokens, so outstanding old invite links should be reissued.

Sources:
https://github.com/n8n-io/n8n/releases
https://github.com/n8n-io/n8n/pull/41863
https://github.com/n8n-io/n8n/commit/a9674866d075e989a5ce896432262c9a7dc8b0c7
https://github.com/n8n-io/n8n/security/advisories
https://community.n8n.io/t/security-update-28-october-2026/325135

Sources:

Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky