CVE-2026-65593 PUBLISHED

n8n before 1.123.64 SSRF via Dynamic Node Parameters

Assigner: VulnCheck
Reserved: 22.07.2026 Published: 22.07.2026 Updated: 22.07.2026

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N
CVSS Score: 6.3

Product Status

Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 1.123.64 (excl.)
  • Version 1.123.64 is unaffected
Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.30.1 (excl.)
  • Version 2.30.1 is unaffected
Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.29.8 (excl.)
  • Version 2.29.8 is unaffected

Credits

  • al1z4deh reporter

References

Problem Types

  • Server-Side Request Forgery (SSRF) CWE