Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security flaw allows logged-in users to bypass network restrictions and force the n8n server to send requests to internal systems that should be private. This could allow an attacker to access sensitive internal data or interact with other services on the local network that are not exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in n8n's '/rest/dynamic-node-parameters/' endpoints due to a lack of proper authorization scopes and insufficient validation of routing configurations. An authenticated attacker can provide an absolute URL in the routing configuration to override the 'baseURL' restriction, which is intended to limit requests to specific upstream services. If the 'N8N_SSRF_PROTECTION_ENABLED' setting is set to false (the default), the server will execute HTTP requests to arbitrary internal targets. This allows for internal port scanning or interaction with internal-only APIs. The issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Affected products
- n8n-io n8n < 1.123.64, < 2.29.8, < 2.30.1
Timeline
- 2026-07-08: advisory: Original advisory GHSA-9w78-79q7-r4fp published
- 2026-07-22: disclosed: CVE-2026-65593 published