A significant security flaw, identified as CVE-2026-85172, has been discovered in n8n, an open-source workflow automation platform. This vulnerability is a type of Server-Side Request Forgery (SSRF) and affects n8n versions before 2.34.1. It presents a medium severity risk to affected systems.
In simple terms, an SSRF vulnerability allows an attacker to trick a server into making requests to other internal systems on their behalf. Imagine a system that needs to fetch information from various web addresses. If not properly secured, an attacker can manipulate the request to point to sensitive internal addresses that should never be publicly accessible. This particular flaw in n8n’s legacy request helper function allowed attackers to bypass existing security checks. The system was designed to validate a “uri” property for safety, but when both a “uri” and a “url” property were provided, it would prioritize the “url” for the actual request. This allowed malicious actors to provide a safe “uri” to pass validation, while simultaneously supplying a harmful “url” to access internal network resources, exposing sensitive data or internal systems.
CVE Details
- Product: n8n
- Published Date: September 3, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This Server-Side Request Forgery vulnerability impacts n8n versions prior to 2.34.1. Specifically, n8n version 2.34.0 is known to be affected, as are any earlier versions that have not been updated.
Current Status
The vulnerability has been thoroughly analyzed. Information regarding the nature of the flaw, its potential impact, and available solutions has been publicly disclosed to help users protect their systems.
Severity Level
The CVE-2026-85172 vulnerability carries a Medium severity rating, with a CVSS score of 6.4. A medium severity indicates that while exploitation might not always be trivial, a successful attack could still lead to significant consequences. In this case, an attacker could potentially gain unauthorized access to internal services or data within your network that the n8n instance can reach. This could lead to information disclosure or further compromise of your infrastructure.
Possible Solutions
To protect your n8n instance from this SSRF vulnerability, it is crucial to apply the available patches:
- Upgrade: The issue has been fixed in n8n versions 2.33.4 and 2.34.1. Users should upgrade their n8n installation to version 2.34.1 or later, or to 2.33.4 or later, to remediate this vulnerability.
If an immediate upgrade is not feasible, the following temporary workarounds can help reduce the risk, but they do not fully eliminate it:
- Restrict Access: Limit access to your n8n instance to only fully trusted users. This reduces the attack surface by ensuring only authorized personnel can potentially interact with the vulnerable function.
- Disable Code Node Access: For untrusted users, disable their access to Code and Function nodes within n8n workflows. Since the vulnerability is exposed through these nodes, restricting their use can prevent exploitation.
- Review Outbound Proxy: If you use an outbound proxy with n8n, carefully review its configuration. Consider temporarily removing it if it’s not strictly necessary, until your instance can be fully patched. Proxies can sometimes inadvertently aid in SSRF attacks if not configured with extreme caution.
These workarounds are temporary and should be implemented only until you can apply the recommended software updates.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj
https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass
