Executive brief
n8n is a workflow automation tool used to connect different software services. A security flaw allows any logged-in user to bypass restrictions and force the n8n server to send requests to internal company systems. This could lead to the exposure of sensitive internal data or unauthorized access to private network services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in n8n's dynamic node parameters endpoints. The root cause is a lack of authorization scopes in the '/rest/dynamic-node-parameters/' endpoints, combined with the ability to override a node's 'baseURL' by providing an absolute URL in the routing configuration. An authenticated attacker, regardless of their permissions to create or execute workflows, can exploit this to make the server issue HTTP requests to arbitrary internal targets. The risk is heightened because SSRF protection is disabled by default in many configurations. Patches are available in versions 1.123.64, 2.29.8, and 2.30.1.
Affected products
- n8n-io n8n < 1.123.64, >= 2.0.0-rc.0, < 2.29.8, >= 2.30.0, < 2.30.1
Timeline
- 2026-07-08: disclosed: Initial disclosure by reporter
- 2026-07-22: advisory: GitHub Advisory published