n8n EUVD-2026-63263

The Edit Image node must be present and the Draw Text sub-operation must be used in a workflow accessible to the attacker. The attacker must be an authenticated n8n user with at minimum low-privilege access to create or modify workflows (PR:L per CVSS 4.0 vector). High attack complexity (AC:H) and specific preconditions (AT:P) indicate that exploitation is not trivially repeatable: the attacker must understand MVG injection syntax and identify a reachable internal target to extract meaningful data. SSRF impact is only realized if the n8n host has network access to sensitive internal endpoints (metadata services, internal APIs) or sensitive local files. Exploitation is limited to confidentiality (read-only); it does not directly allow file writes or service disruption. Unauthenticated exploitation is not possible - valid n8n credentials are required.

The CVSS 4.0 score of 6.0 with AV:N/AC:H/AT:P/PR:L reflects a network-reachable flaw that requires elevated attack complexity and specific preconditions, tempering the raw network-accessible nature of the issue. Real-world risk is deployment-dependent: n8n instances accessible to low-trust authenticated users that also have unfettered egress to internal RFC 1918 ranges or cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) present the most acute exposure. The High confidentiality impact (VC:H) is meaningful - successful SSRF against a metadata endpoint can yield cloud credentials with broad blast radius, far exceeding the scope implied by the 6.0 base score. EPSS data is not available in this feed; KEV listing is absent and no public exploit code has been identified, which justifies measured rather than emergency response. Integrity and availability scores are N/N, confirming this is a read-only exfiltration primitive. The RCE tag in the source data is not corroborated by the CVSS impact metrics and should be treated as an unconfirmed research hypothesis - if MVG injection can be escalated to arbitrary command execution (as seen historically with ImageMagick), actual severity would be substantially higher. Organizations should verify whether the Edit Image node is exposed to untrusted authenticated users before determining urgency.

An authenticated n8n user with workflow creation privileges builds a Draw Text configuration in an Edit Image node, embedding a crafted MVG url() directive such as 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)' in the text value field. When the workflow executes, the n8n host's ImageMagick process issues a blind outbound HTTP request to the specified target; the attacker retrieves the response via a controlled HTTP listener or timing side-channel. No public exploit code has been identified, but the technique is well-documented for the ImageMagick MVG processing class.