GHSA-38fj-36m5-783c

Summary

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Severity

medium

CWE

CWE-918

Published

2026-07-22

Updated

2026-07-22

Advisory details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references.

Original Description

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

References

• https://github.com/advisories/GHSA-38fj-36m5-783c
• https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp
• https://nvd.nist.gov/vuln/detail/CVE-2026-65593
• https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters

Related advisories

• CVE-2026-86082 — high · npm/n8n
• GHSA-2x35-3fw4-9jr4 — high · npm/n8n
• CVE-2026-86074 — medium · npm/n8n
• GHSA-vhf8-cg2h-cg3p — medium · npm/n8n
• CVE-2026-86083 — high · npm/n8n
• CVE-2026-86081 — high · npm/n8n
• CVE-2026-86075 — high · npm/n8n
• CVE-2026-86076 — high · npm/n8n

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity