n8n SSRF and credential exfiltration in dynamic-node-parameters

Executive brief

n8n is a workflow automation tool used to connect various business applications and services. A security vulnerability in the platform allowed authenticated users to bypass security restrictions and force the server to send sensitive credentials to unauthorized external domains. This could lead to the theft of service account passwords or API keys, potentially compromising the third-party applications connected to the n8n environment.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in n8n's 'POST /rest/dynamic-node-parameters/options' endpoint. The vulnerability allows an authenticated user with access to a specific credential to bypass the 'Allowed HTTP Request Domains' security restriction. By exploiting this, an attacker can cause the n8n server to issue an HTTP request containing the credential to an arbitrary, attacker-controlled host. This results in the exfiltration of sensitive authentication data. The issue is fixed in version 2.20.0.

Affected products

• n8n-io n8n < 2.20.0

Timeline

• 2026-05-19: advisory: GitHub Advisory GHSA-3875-8gcx-7v46 published.
• 2026-05-19: patched: Fix released in version 2.20.0.

References

• https://api.github.com/users/vnth4nhnt
• https://github.com/vnth4nhnt
• https://api.github.com/users/vnth4nhnt/gists%7B/gist_id%7D
• https://api.github.com/users/vnth4nhnt/repos
• https://avatars.githubusercontent.com/u/159286161?v=4
• https://api.github.com/users/vnth4nhnt/events%7B/privacy%7D