CVE-2026-65593: n8n SSRF bypass — MEDIUM

CISO Take

n8n's dynamic-node-parameters endpoints ship without proper authorization scopes, letting any authenticated user supply an absolute URL that overrides the platform's baseURL restrictions and forces the n8n server to make HTTP requests to arbitrary internal targets whenever SSRF protection is toggled off. This matters because n8n sits at the center of many AI agent stacks — orchestrating calls to LLM APIs, vector databases, and internal services — so a successful SSRF here can reach cloud metadata endpoints or internal admin interfaces the agent was never meant to touch, and the package already carries a 69/100 risk score with 150 other recorded CVEs and only a 6.6/10 OpenSSF Scorecard. There's no CVSS score, no CISA KEV listing, no public exploit, and no Nuclei template yet, so this isn't an emergency drop-everything patch, but the authentication bar is low in most n8n deployments where several users typically hold workflow-editor access. Patch to n8n 1.123.64 or later, and in the meantime keep SSRF protection enabled and enforce baseURL allowlists at the network layer rather than relying on the application alone. Monitor outbound requests from n8n workflow executions for calls to internal IP ranges or cloud metadata addresses (169.254.169.254) as a detection signal.

Sources: NVD GitHub Advisory CISA KEV OpenSSF ATLAS

What is the risk?

Moderate risk overall: exploitation requires an authenticated account, and public exploitation signals are all absent (no CVSS score published, not in CISA KEV, no public PoC or Nuclei template, EPSS unavailable). However, the barrier is low in practice — n8n commonly grants workflow-editor roles to multiple internal users or partner integrators, and the vulnerability requires no special AI/ML expertise, just knowledge of n8n's node-parameters routing config (CWE-918, classic SSRF). The package's broader risk profile compounds this: n8n carries 150 other recorded CVEs and a below-average OpenSSF Scorecard (6.6/10), suggesting an application surface that warrants closer scrutiny across the board, not just this one flaw.

How does the attack unfold?

Initial Access

Attacker uses an existing authenticated n8n account (e.g., contractor or compromised workflow-editor credential) to access the node configuration editor.

AML.T0012

Exploitation

Attacker configures a dynamic-node-parameters routing setting with an absolute URL, overriding baseURL restrictions since the endpoint lacks proper authorization scopes.

AML.T0049

Request Forgery

With SSRF protection disabled, the n8n server issues an HTTP request to an internal target such as cloud metadata services or internal admin APIs on the attacker's behalf.

Impact

The internal response (e.g., cloud IAM credentials or internal API data) is returned in the workflow output, enabling credential theft and further pivoting into internal infrastructure feeding the AI agent pipeline.

Initial Access

Attacker uses an existing authenticated n8n account (e.g., contractor or compromised workflow-editor credential) to access the node configuration editor.

AML.T0012

Exploitation

Attacker configures a dynamic-node-parameters routing setting with an absolute URL, overriding baseURL restrictions since the endpoint lacks proper authorization scopes.

AML.T0049

Request Forgery

With SSRF protection disabled, the n8n server issues an HTTP request to an internal target such as cloud metadata services or internal admin APIs on the attacker's behalf.

Impact

The internal response (e.g., cloud IAM credentials or internal API data) is returned in the workflow output, enabling credential theft and further pivoting into internal infrastructure feeding the AI agent pipeline.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade to n8n >=1.123.64, which restores authorization scopes on the dynamic-node-parameters endpoints. 2) Do not disable SSRF protection in n8n's security settings — this vulnerability is only exploitable when that protection is off. 3) Enforce baseURL allowlisting and egress firewall rules blocking outbound traffic to internal RFC1918 ranges and 169.254.169.254 as defense-in-depth, independent of the application patch. 4) Audit which user roles have workflow-editing permissions in n8n and tighten authorization scopes to least privilege. 5) Detection: monitor n8n execution logs and outbound network telemetry for HTTP requests originating from workflow nodes that target internal IP ranges or metadata services.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - Security controls for AI system components

NIST AI RMF

MANAGE-4.1 - Risk treatment and ongoing monitoring

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-65593?

n8n's dynamic-node-parameters endpoints ship without proper authorization scopes, letting any authenticated user supply an absolute URL that overrides the platform's baseURL restrictions and forces the n8n server to make HTTP requests to arbitrary internal targets whenever SSRF protection is toggled off. This matters because n8n sits at the center of many AI agent stacks — orchestrating calls to LLM APIs, vector databases, and internal services — so a successful SSRF here can reach cloud metadata endpoints or internal admin interfaces the agent was never meant to touch, and the package already carries a 69/100 risk score with 150 other recorded CVEs and only a 6.6/10 OpenSSF Scorecard. There's no CVSS score, no CISA KEV listing, no public exploit, and no Nuclei template yet, so this isn't an emergency drop-everything patch, but the authentication bar is low in most n8n deployments where several users typically hold workflow-editor access. Patch to n8n 1.123.64 or later, and in the meantime keep SSRF protection enabled and enforce baseURL allowlists at the network layer rather than relying on the application alone. Monitor outbound requests from n8n workflow executions for calls to internal IP ranges or cloud metadata addresses (169.254.169.254) as a detection signal.

Is CVE-2026-65593 actively exploited?

No confirmed active exploitation of CVE-2026-65593 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65593?

1) Upgrade to n8n >=1.123.64, which restores authorization scopes on the dynamic-node-parameters endpoints. 2) Do not disable SSRF protection in n8n's security settings — this vulnerability is only exploitable when that protection is off. 3) Enforce baseURL allowlisting and egress firewall rules blocking outbound traffic to internal RFC1918 ranges and 169.254.169.254 as defense-in-depth, independent of the application patch. 4) Audit which user roles have workflow-editing permissions in n8n and tighten authorization scopes to least privilege. 5) Detection: monitor n8n execution logs and outbound network telemetry for HTTP requests originating from workflow nodes that target internal IP ranges or metadata services.

What systems are affected by CVE-2026-65593?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-65593?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

Exploitation Scenario

An attacker who has obtained low-privilege but authenticated access to a shared n8n instance — e.g., a contractor account or a compromised credential from a workflow collaborator — opens the node editor and configures a node's dynamic-node-parameters routing to specify an absolute URL pointing at an internal target, such as the cloud provider's metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/) or an internal admin API that trusts requests originating from the n8n host. Because the endpoint lacks proper authorization scopes and SSRF protection is disabled, n8n's backend faithfully issues the request and returns the response inside the workflow execution output, handing the attacker cloud IAM credentials or internal API data. From there, the attacker pivots using the harvested credentials to access broader cloud infrastructure or the internal services that feed the organization's AI agent pipelines.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.