Executive brief
n8n is a workflow automation platform that allows users to create and run automation scripts using Code and Function nodes. This vulnerability allows authenticated users to bypass security checks and make requests to internal or private network addresses, potentially exposing sensitive internal systems or data that should not be accessible from outside the organization.
Technical details
The legacy helpers.request() function exposed to Code and Function nodes contains a server-side request forgery (SSRF) vulnerability due to a mismatch between validation and execution logic. The SSRF validation checks the uri property for safety, but the underlying HTTP client (Axios) uses the url property when both are present, allowing an attacker to provide a benign uri value that passes validation while supplying a malicious url that is actually dispatched. An authenticated user with Code or Function node access can exploit this to access internal addresses and potentially exfiltrate data. The vulnerability has been patched in versions 2.33.4 and 2.34.1.
Affected products
- n8n n8n before 2.34.1, before 2.33.4
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory: Published to NVD
- 2026-08-19: patched: Versions 2.33.4 and 2.34.1 released