EUVD-2026-63258
GHSA-4x7w-pwq5-598q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable exploit requiring credential-creation privileges (PR:L), scope changes to internal systems via SSRF (S:C), with only low confidentiality impact and no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).
AnalysisAI
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid n8n user account that has been granted the credential-creation permission - this is a non-default, operator-assigned permission level, not available to anonymous or read-only users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) scores only 2.3, accurately reflecting several mitigating factors: exploitation requires an authenticated user account with credential-creation privileges (PR:L), the attack requirements metric AT:P signals that a specific configuration step - setting a malicious access-token URL and completing the OAuth2 authorization code flow - must be carried out, and the impact is limited to low-confidence reads of what internal services return to a fixed-shape POST body. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privileged n8n account with credential-creation rights creates a new OAuth2 credential and sets the access-token URL to an internal address such as http://169.254.169.254/latest/meta-data/ (cloud instance metadata) or an internal microservice endpoint. The attacker then initiates the OAuth2 authorization-code flow within n8n; when n8n reaches the token-exchange step, it issues an unguarded POST to the configured internal URL and returns the response body to the attacker's browser, exposing whatever the internal service returns to that request shape. … |
| Remediation | Upgrade n8n to version 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), or 2.34.1 (v2.34 branch), whichever applies to the installed release train - these are the vendor-released patched versions confirmed in GitHub Security Advisory GHSA-c4f6-59xq-95ww. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today