AI Threat Alertn8n's OpenAI Chat Model node enforced credential allowed-domain restrictions on normal API calls but forgot to apply the same check to its model-search dropdown, letting a workflow editor point options.baseURL at an attacker-controlled host and have the stored openAiApi credential sent there. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this isn't a mass-exploited bug — but n8n is a widely deployed AI agent/automation framework, and the flaw effectively turns a documented credential-scoping control into a no-op for anyone with workflow-edit rights, which is exactly the kind of insider or low-privilege-account risk compliance frameworks ask you to close. Any team relying on n8n's allowed-domain restriction as a compensating control for OpenAI credential exposure should treat that assumption as broken until patched. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime tighten who can create/edit workflows using OpenAI credentials and audit egress from n8n hosts for unexpected destinations.
What is the risk?
Moderate risk. Exploitation requires an authenticated actor with workflow-editing privileges in n8n (insider threat, compromised low-privilege account, or a malicious collaborator), not an unauthenticated remote attacker — this caps the blast radius compared to a pure RCE. However, the impact is a direct credential leak (OpenAI API key) via SSRF (CWE-918), which is straightforward to exploit once access is obtained: no advanced AI/ML knowledge is needed, just setting a config field. No KEV listing, no EPSS data, and no public PoC/scanner exist yet, indicating low current exploitation likelihood, but the simplicity of the bug (a single missing validation call, assertOpenAiCredentialAllowsUrl) means a working exploit is trivial to reproduce from the GHSA advisory.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | < 1.123.76 | 1.123.76 |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepPatch n8n to 1.123.76, 2.37.7, or 2.38.2 where assertOpenAiCredentialAllowsUrl is enforced in loadModels.ts. Until patched: restrict workflow creation/editing permissions to trusted users only, treat any OpenAI credential configured with allowed-domain restrictions as potentially bypassable, and monitor network egress from n8n instances for outbound requests to unexpected/non-OpenAI hosts carrying Authorization headers. After patching, rotate any OpenAI API keys that were used in workflows editable by lower-trust users prior to the fix, and review n8n audit logs for baseURL or model-search parameter anomalies.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-86082?
n8n's OpenAI Chat Model node enforced credential allowed-domain restrictions on normal API calls but forgot to apply the same check to its model-search dropdown, letting a workflow editor point options.baseURL at an attacker-controlled host and have the stored openAiApi credential sent there. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this isn't a mass-exploited bug — but n8n is a widely deployed AI agent/automation framework, and the flaw effectively turns a documented credential-scoping control into a no-op for anyone with workflow-edit rights, which is exactly the kind of insider or low-privilege-account risk compliance frameworks ask you to close. Any team relying on n8n's allowed-domain restriction as a compensating control for OpenAI credential exposure should treat that assumption as broken until patched. Upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the meantime tighten who can create/edit workflows using OpenAI credentials and audit egress from n8n hosts for unexpected destinations.
Is CVE-2026-86082 actively exploited?
No confirmed active exploitation of CVE-2026-86082 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-86082?
Patch n8n to 1.123.76, 2.37.7, or 2.38.2 where assertOpenAiCredentialAllowsUrl is enforced in loadModels.ts. Until patched: restrict workflow creation/editing permissions to trusted users only, treat any OpenAI credential configured with allowed-domain restrictions as potentially bypassable, and monitor network egress from n8n instances for outbound requests to unexpected/non-OpenAI hosts carrying Authorization headers. After patching, rotate any OpenAI API keys that were used in workflows editable by lower-trust users prior to the fix, and review n8n audit logs for baseURL or model-search parameter anomalies.
What systems are affected by CVE-2026-86082?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integration, workflow automation pipelines.
What is the CVSS score for CVE-2026-86082?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0083Credentials from AI Agent ConfigurationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Exploitation Scenario
A contractor or compromised low-privilege account with workflow-edit access in a shared n8n instance opens an existing workflow that uses the OpenAI Chat Model node with a credential restricted to api.openai.com. Instead of using normal node execution (which correctly enforces the allowed-domain check), the actor uses the node's model-search dropdown and sets options.baseURL to an attacker-controlled server. n8n's searchModels function sends the openAiApi credential to that attacker server to fetch the model list, silently exfiltrating the API key. The attacker then uses the stolen key to make unauthorized OpenAI API calls billed to the victim, potentially accessing any data or prompts sent through that key elsewhere, or running large-scale queries to exhaust the victim's quota.
Weaknesses (CWE)
CWE-918Server-Side Request ForgeryPrimaryCWE-918Server-Side Request Forgery (SSRF)PrimaryCWE-918Server-Side Request ForgeryCWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- [Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
- [Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2025-686689.9n8n: Protection Bypass circumvents security controls
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n