CVE-2026-86074: n8n SSRF — MEDIUM

Q: Is CVE-2026-86074 actively exploited?

No confirmed active exploitation of CVE-2026-86074 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86074?

1) Upgrade n8n to 2.37.7 (2.37.x branch) or 2.38.2 (2.38.x branch) immediately — both contain the fix. 2) Until patched, restrict outbound network egress from n8n worker/execution containers to only known AI provider domains to blunt SSRF impact. 3) Audit workflow definitions and credential test logs for verification calls that reached unexpected or non-provider origins. 4) Rotate any AI provider API keys/tokens that were configured through the Instance AI credential setup flow prior to patching, as a precaution against silent exfiltration. 5) Monitor egress logs post-patch for anomalous outbound requests tied to credential-test activity.

Q: What systems are affected by CVE-2026-86074?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, credential management for AI integrations.

Q: What is the CVSS score for CVE-2026-86074?

No CVSS score has been assigned yet.

CISO Take

n8n's Instance AI credential setup flow fails to verify that a credential test/verification URL actually matches the origin of the workflow node requesting it, letting attacker-influenced content redirect authenticated verification requests to a third-party origin. There is no CVSS score, no EPSS percentile, no CISA KEV listing, and no public exploit or Nuclei template yet, and the package shows zero tracked downstream dependents in our data — so this is not an imminent mass-exploitation risk today. That said, the bug class (CWE-918 SSRF) combined with n8n's role as a workflow automation platform wiring together AI credentials and external services means a successful abuse could leak stored API keys or tokens to an attacker-controlled server, or be used to probe internal infrastructure the n8n instance can reach. n8n has 212 other CVEs on record and a mid-tier OpenSSF Scorecard (6.7/10), reinforcing that this is a platform with a broad and recurring attack surface rather than an isolated flaw. Action: upgrade self-hosted n8n instances to 2.37.7 or 2.38.2 immediately, and audit any AI credentials configured via the Instance AI setup flow for signs of exposure to unexpected origins.

Sources: NVD GitHub Advisory ATLAS OpenSSF

What is the risk?

Low-to-moderate immediate risk given the absence of a CVSS score, EPSS data, KEV listing, or known public exploit/scanner coverage — this looks like a responsibly-disclosed, pre-mass-exploitation SSRF. However, the underlying weakness class (CWE-918, origin validation failure in a credential verification path) is high-value if weaponized, since successful abuse can exfiltrate AI provider credentials or pivot into internal network reconnaissance. Risk should be treated as elevated for any n8n instance that self-hosts workflow automation with Instance AI credentials configured, especially internet-facing or multi-tenant deployments, until patched.

How does the attack unfold?

Content Ingestion

An n8n workflow ingests external content (e.g., a scraped page, API response, or shared workflow config) that is attacker-controlled.

AML.T0066

Origin Manipulation

The ingested content influences the value later used by extractServiceOrigin, and n8n fails to verify it matches the workflow node's true origin.

AML.T0051.001

SSRF / Credential Exposure

n8n issues an authenticated credential-test request to the attacker's server instead of the legitimate AI provider, exposing the credential or enabling internal probing.

AML.T0098

Impact

The attacker captures the leaked AI credential or reconnaissance data, enabling further abuse such as API cost fraud or lateral movement.

AML.T0025

Content Ingestion

An n8n workflow ingests external content (e.g., a scraped page, API response, or shared workflow config) that is attacker-controlled.

AML.T0066

Origin Manipulation

The ingested content influences the value later used by extractServiceOrigin, and n8n fails to verify it matches the workflow node's true origin.

AML.T0051.001

SSRF / Credential Exposure

n8n issues an authenticated credential-test request to the attacker's server instead of the legitimate AI provider, exposing the credential or enabling internal probing.

AML.T0098

Impact

The attacker captures the leaked AI credential or reconnaissance data, enabling further abuse such as API cost fraud or lateral movement.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.38.0, < 2.38.2	`2.38.2`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade n8n to 2.37.7 (2.37.x branch) or 2.38.2 (2.38.x branch) immediately — both contain the fix. 2) Until patched, restrict outbound network egress from n8n worker/execution containers to only known AI provider domains to blunt SSRF impact. 3) Audit workflow definitions and credential test logs for verification calls that reached unexpected or non-provider origins. 4) Rotate any AI provider API keys/tokens that were configured through the Instance AI credential setup flow prior to patching, as a precaution against silent exfiltration. 5) Monitor egress logs post-patch for anomalous outbound requests tied to credential-test activity.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0051.001 - Indirect AML.T0083 - Credentials from AI Agent Configuration AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-86074?

n8n's Instance AI credential setup flow fails to verify that a credential test/verification URL actually matches the origin of the workflow node requesting it, letting attacker-influenced content redirect authenticated verification requests to a third-party origin. There is no CVSS score, no EPSS percentile, no CISA KEV listing, and no public exploit or Nuclei template yet, and the package shows zero tracked downstream dependents in our data — so this is not an imminent mass-exploitation risk today. That said, the bug class (CWE-918 SSRF) combined with n8n's role as a workflow automation platform wiring together AI credentials and external services means a successful abuse could leak stored API keys or tokens to an attacker-controlled server, or be used to probe internal infrastructure the n8n instance can reach. n8n has 212 other CVEs on record and a mid-tier OpenSSF Scorecard (6.7/10), reinforcing that this is a platform with a broad and recurring attack surface rather than an isolated flaw. Action: upgrade self-hosted n8n instances to 2.37.7 or 2.38.2 immediately, and audit any AI credentials configured via the Instance AI setup flow for signs of exposure to unexpected origins.

Is CVE-2026-86074 actively exploited?

No confirmed active exploitation of CVE-2026-86074 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86074?

1) Upgrade n8n to 2.37.7 (2.37.x branch) or 2.38.2 (2.38.x branch) immediately — both contain the fix. 2) Until patched, restrict outbound network egress from n8n worker/execution containers to only known AI provider domains to blunt SSRF impact. 3) Audit workflow definitions and credential test logs for verification calls that reached unexpected or non-provider origins. 4) Rotate any AI provider API keys/tokens that were configured through the Instance AI credential setup flow prior to patching, as a precaution against silent exfiltration. 5) Monitor egress logs post-patch for anomalous outbound requests tied to credential-test activity.

What systems are affected by CVE-2026-86074?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, credential management for AI integrations.

What is the CVSS score for CVE-2026-86074?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation pipelinescredential management for AI integrations

MITRE ATLAS Techniques

AML.T0051.001 Indirect

AML.T0083 Credentials from AI Agent Configuration

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.

Exploitation Scenario

A user (or an automated workflow ingesting external content) sets up an AI credential through n8n's Instance AI flow. Content fetched by the workflow — for example from a scraped webpage, an API response, or a shared workflow template — is attacker-controlled and manipulates the value later used by extractServiceOrigin to derive the credential test/verification URL. Because n8n doesn't confirm this URL matches the workflow node's true origin, n8n issues an authenticated request (carrying the stored AI credential) to the attacker's server instead of the legitimate AI provider, allowing the attacker to capture the token, observe internal-only endpoints the n8n host can reach, or chain the SSRF into further reconnaissance of the hosting environment.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.