# Security notice: cannot disable vulnerable workflows after downgrade

**URL:** <https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931>\
**Category:** APIs & Integrations\
**Tags:** free\
**Created:** [November 4, 2026, 9:48am UTC](https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931 "2026-11-04T09:48:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amien](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@amien](https://community.hubspot.com/u/amien)\
**Post date:** [November 4, 2026, 9:49am UTC](https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931/1 "2026-11-04T09:49:00Z")

</div>

Our account received HubSpot’s Node.js custom-code vulnerability notice, but after downgrading we cannot access Workflows to follow the security instructions.

Please escalate this to Support/Security. We need all existing workflows disabled without deleting workflows or CRM data, and confirmation that custom-code actions cannot execute.

We have already rotated and immediately expired all six private-app access tokens. Please provide a private channel for our account ID and further investigation.

---

<div class="post-metadata">

**Author:** ![UttamM](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/uttamm/32/229674_2.png) [@UttamM](https://community.hubspot.com/u/UttamM)\
**Post date:** [November 4, 2026, 3:30pm UTC](https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931/3 "2026-11-04T15:30:55Z")

</div>

Could a HubSpot Community moderator help arrange a private escalation to Support/Security? Since the downgrade prevents access to Workflows, this needs an account-specific review.

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [November 4, 2026, 5:15pm UTC](https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931/5 "2026-11-04T17:15:05Z")

</div>

Hi @amien and welcome to the HubSpot Community!

I’ll be reaching out via DM to follow up on this. And thanks @UttamM for flagging!

Bérangère, HubSpot Community Manager

---

<div class="post-metadata">

**Author:** ![ManharChaurasia](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@ManharChaurasia](https://community.hubspot.com/u/ManharChaurasia)\
**Post date:** [November 5, 2026, 5:44am UTC](https://community.hubspot.com/t/security-notice-cannot-disable-vulnerable-workflows-after-downgrade/163931/6 "2026-11-05T05:44:41Z")

</div>

Rotating the private app tokens was the right first move. One more thing to check: if any custom code actions used secrets for other services (a Stripe key, a Slack webhook, your own API), rotate those at the source too, since turning the workflows off doesn’t make a leaked key safe.

On the workflows themselves, I think custom code can’t run once the account no longer has Operations Hub Pro, but I wouldn’t lean on my guess for a security issue. The notice email should have a reply path or case reference, which will get you a private channel faster than this thread