Executive brief
n8n is a workflow automation platform that integrates with services like OpenAI. Administrators can restrict which domains OpenAI API credentials can be used with for security purposes. However, the model-search feature in the OpenAI Chat Model node bypassed these domain restrictions, allowing users to send authenticated API requests to arbitrary external servers. An attacker with access to n8n could exploit this to steal or misuse OpenAI credentials.
Technical details
The vulnerability exists in n8n's OpenAI Chat Model node, which implements domain-restriction checks on the main API endpoint but fails to enforce the same checks on the model-search dropdown endpoint. When a user interacts with the model-search dropdown to list available OpenAI models, the endpoint allows setting an arbitrary options.baseURL parameter that is not validated against the credential's allowed-domains configuration. This permits an authenticated user to route requests through the OpenAI credential to any external host, effectively bypassing administrative domain restrictions. The attack requires n8n instance access and valid OpenAI credentials with domain restrictions configured. The patch consolidates all OpenAI call sites (including model listing) through a shared allowed-domains validation function. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2 and later.
Affected products
- n8n-io n8n All versions < 1.123.76, all versions 2.0.0 to < 2.37.7, all versions 2.38.0 to < 2.38.2
Timeline
- 2026-09-02: disclosed: Advisory published by n8n security team
- 2026-09-02: patched: Fixes released in versions 1.123.76, 2.37.7, and 2.38.2