Executive brief
n8n is a workflow automation platform that allows users to create integrations with third-party services via OAuth2 credentials. A vulnerability in the OAuth2 token exchange process allows any user with credential-creation permissions to bypass SSRF protections and make the n8n server send requests to internal network addresses. An attacker could probe internal services or extract sensitive information from their responses, potentially gaining access to internal infrastructure or exposing confidential data.
Technical details
This is a Server-Side Request Forgery (SSRF) protection bypass in n8n's OAuth2 credential authorization-code-to-access-token exchange (CWE-918). While OAuth2 discovery and dynamic-client-registration requests correctly use n8n's SSRF-protected HTTP client, the token exchange uses a separate, unprotected HTTP client. An authenticated user with credential-creation permissions can set the access-token URL to an internal address (e.g., 127.0.0.1, private IP ranges) and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST request to that target. The attacker cannot control the request method, headers, or body shape, but receives the target's response reflected back, allowing information disclosure about internal services. The vulnerability has been patched in versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n before 1.123.69, before 2.33.4, before 2.34.1
Timeline
- 2026-08-05: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: versions 1.123.69, 2.33.4, and 2.34.1 released