CVE-2026-86082: n8n OpenAI node leaks API key

Q: Is CVE-2026-86082 actively exploited?

No confirmed active exploitation of CVE-2026-86082 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86082?

Patch n8n to 1.123.76, 2.37.7, or 2.38.2 where assertOpenAiCredentialAllowsUrl is enforced in loadModels.ts. Until patched: restrict workflow creation/editing permissions to trusted users only, treat any OpenAI credential configured with allowed-domain restrictions as potentially bypassable, and monitor network egress from n8n instances for outbound requests to unexpected/non-OpenAI hosts carrying Authorization headers. After patching, rotate any OpenAI API keys that were used in workflows editable by lower-trust users prior to the fix, and review n8n audit logs for baseURL or model-search parameter anomalies.

Q: What systems are affected by CVE-2026-86082?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integration, workflow automation pipelines.

Q: What is the CVSS score for CVE-2026-86082?

No CVSS score has been assigned yet.

CISO Take

n8n's OpenAI Chat Model node enforced credential allowed-domain restrictions on normal API calls but forgot to apply the same check to its model-search dropdown, letting a workflow editor point options.baseURL at an attacker-controlled host and have the stored openAiApi credential sent there. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this isn't a mass-exploited bug — but n8n is a widely deployed AI agent/automation framework, and the flaw effectively turns a documented credential-scoping control into a no-op for anyone with workflow-edit rights, which is exactly the kind of insider or low-privilege-account risk compliance frameworks ask you to close. Any team relying on n8n's allowed-domain restriction as a compensating control for OpenAI credential exposure should treat that assumption as broken until patched. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime tighten who can create/edit workflows using OpenAI credentials and audit egress from n8n hosts for unexpected destinations.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Moderate risk. Exploitation requires an authenticated actor with workflow-editing privileges in n8n (insider threat, compromised low-privilege account, or a malicious collaborator), not an unauthenticated remote attacker — this caps the blast radius compared to a pure RCE. However, the impact is a direct credential leak (OpenAI API key) via SSRF (CWE-918), which is straightforward to exploit once access is obtained: no advanced AI/ML knowledge is needed, just setting a config field. No KEV listing, no EPSS data, and no public PoC/scanner exist yet, indicating low current exploitation likelihood, but the simplicity of the bug (a single missing validation call, assertOpenAiCredentialAllowsUrl) means a working exploit is trivial to reproduce from the GHSA advisory.

How does the attack unfold?

Initial Access

An actor with workflow-edit permissions (insider, contractor, or compromised low-privilege account) opens a workflow using the OpenAI Chat Model node.

AML.T0012

Control Bypass

The actor sets options.baseURL to an attacker-controlled host in the model-search dropdown, which skips the assertOpenAiCredentialAllowsUrl domain check applied to normal calls.

AML.T0098

Credential Exfiltration

n8n's searchModels function sends the openAiApi credential to the attacker-controlled host, leaking the OpenAI API key.

AML.T0083

Impact

The attacker reuses the stolen OpenAI API key for unauthorized access, data exposure, or cost/quota abuse against the victim's OpenAI account.

AML.T0034

Initial Access

An actor with workflow-edit permissions (insider, contractor, or compromised low-privilege account) opens a workflow using the OpenAI Chat Model node.

AML.T0012

Control Bypass

The actor sets options.baseURL to an attacker-controlled host in the model-search dropdown, which skips the assertOpenAiCredentialAllowsUrl domain check applied to normal calls.

AML.T0098

Credential Exfiltration

n8n's searchModels function sends the openAiApi credential to the attacker-controlled host, leaking the OpenAI API key.

AML.T0083

Impact

The attacker reuses the stolen OpenAI API key for unauthorized access, data exposure, or cost/quota abuse against the victim's OpenAI account.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.76	`1.123.76`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Patch n8n to 1.123.76, 2.37.7, or 2.38.2 where assertOpenAiCredentialAllowsUrl is enforced in loadModels.ts. Until patched: restrict workflow creation/editing permissions to trusted users only, treat any OpenAI credential configured with allowed-domain restrictions as potentially bypassable, and monitor network egress from n8n instances for outbound requests to unexpected/non-OpenAI hosts carrying Authorization headers. After patching, rotate any OpenAI API keys that were used in workflows editable by lower-trust users prior to the fix, and review n8n audit logs for baseURL or model-search parameter anomalies.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0083 - Credentials from AI Agent Configuration AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE-2.3 - Mechanisms are in place to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-86082?

n8n's OpenAI Chat Model node enforced credential allowed-domain restrictions on normal API calls but forgot to apply the same check to its model-search dropdown, letting a workflow editor point options.baseURL at an attacker-controlled host and have the stored openAiApi credential sent there. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this isn't a mass-exploited bug — but n8n is a widely deployed AI agent/automation framework, and the flaw effectively turns a documented credential-scoping control into a no-op for anyone with workflow-edit rights, which is exactly the kind of insider or low-privilege-account risk compliance frameworks ask you to close. Any team relying on n8n's allowed-domain restriction as a compensating control for OpenAI credential exposure should treat that assumption as broken until patched. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime tighten who can create/edit workflows using OpenAI credentials and audit egress from n8n hosts for unexpected destinations.

Is CVE-2026-86082 actively exploited?

No confirmed active exploitation of CVE-2026-86082 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86082?

Patch n8n to 1.123.76, 2.37.7, or 2.38.2 where assertOpenAiCredentialAllowsUrl is enforced in loadModels.ts. Until patched: restrict workflow creation/editing permissions to trusted users only, treat any OpenAI credential configured with allowed-domain restrictions as potentially bypassable, and monitor network egress from n8n instances for outbound requests to unexpected/non-OpenAI hosts carrying Authorization headers. After patching, rotate any OpenAI API keys that were used in workflows editable by lower-trust users prior to the fix, and review n8n audit logs for baseURL or model-search parameter anomalies.

What systems are affected by CVE-2026-86082?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integration, workflow automation pipelines.

What is the CVSS score for CVE-2026-86082?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM API integrationworkflow automation pipelines

MITRE ATLAS Techniques

AML.T0083 Credentials from AI Agent Configuration

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation Scenario

A contractor or compromised low-privilege account with workflow-edit access in a shared n8n instance opens an existing workflow that uses the OpenAI Chat Model node with a credential restricted to api.openai.com. Instead of using normal node execution (which correctly enforces the allowed-domain check), the actor uses the node's model-search dropdown and sets options.baseURL to an attacker-controlled server. n8n's searchModels function sends the openAiApi credential to that attacker server to fetch the model list, silently exfiltrating the API key. The attacker then uses the stolen key to make unauthorized OpenAI API calls billed to the victim, potentially accessing any data or prompts sent through that key elsewhere, or running large-scale queries to exhaust the victim's quota.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.