EUVD-2026-74274
GHSA-34ff-336r-5q23
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring only low-privilege editor role; scope changes because the leaked credential directly affects the out-of-scope OpenAI system.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
AnalysisAI
Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding options.baseURL. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of assertOpenAiCredentialAllowsUrl in loadModels.ts, the same domain-restriction guard applied elsewhere in the node. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a workflow editor role within the target n8n instance - this is an authenticated low-privilege position, not anonymous access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (PR:L, VC:H, SC:L) accurately reflects the key risk factors: exploitation requires a low-privilege but authenticated workflow editor role, while the confidentiality impact on the vulnerable system is high - the OpenAI API key is fully disclosed to the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n to the patched release appropriate for your branch: 1.123.76 for v1 deployments (https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76), 2.37.7 for the 2.37.x branch (https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7), or 2.38.2 for the 2.38.x branch (https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2); these releases restore the missing `assertOpenAiCredentialAllowsUrl` call in the model-search path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit n8n user access logs to identify all workflow editors and verify their authorization; cross-check OpenAI API audit logs for anomalous usage patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today