Summary
Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
Advisory details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references.
Original Description
n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.
References
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-75856
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
- CRITICALCVE-2026-71428
unstructured: Server-Side Request Forgery in the URL-based partitioning
- HIGHCVE-2026-65842
Plate: SSRF with response disclosure in DOCX image embedding
- HIGHCVE-2026-61704
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
- HIGHCVE-2026-75975
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- HIGHCVE-2026-75899
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding