CVE-2026-86074: n8n Workflow Automation Platform SSRF Vulnerability

CVE-2026-86074 Overview

CVE-2026-86074 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in n8n, an open source workflow automation platform. The flaw exists in the Instance AI credential setup flow, which accepted a credential test or verification URL without validating that it matched the workflow node's origin. Attacker-influenced content could redirect authenticated requests, redirects, or probes to a different origin than the intended service. The vulnerability affects versions prior to 2.37.7 and 2.38.2, with the flawed logic residing in packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation function.

Critical Impact
Attackers can coerce the n8n instance into issuing authenticated requests to attacker-chosen origins, enabling credential leakage, internal network probing, and cross-origin data exposure.

Affected Products

n8n versions prior to 2.37.7 (2.37.x branch)
n8n versions prior to 2.38.2 (2.38.x branch)
n8n Instance AI credential setup component (@n8n/instance-ai)

Discovery Timeline

2026-09-08 - CVE-2026-86074 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86074

Vulnerability Analysis

The vulnerability resides in the n8n Instance AI credential setup workflow, which handles URLs used to test or verify service credentials. The setup flow accepted a verification URL without confirming that its origin matched the workflow node the credential was bound to. When attacker-controlled content is fetched during the setup process, that content can influence the final verification URL after a user injects it into the flow. This produces a classic SSRF condition where the server issues outbound requests to origins the operator did not intend.

Because the requests originate from the n8n server itself, they carry any authentication material the credential test attaches, and they execute from a position of trust inside the deployment's network. The relevant code paths are in credential-utils.ts and the extractServiceOrigin helper, which failed to enforce an origin match between the node definition and the URL passed to the verification step.

Root Cause

The root cause is missing origin validation between the workflow node's declared service origin and the URL supplied to the credential verification step. The extractServiceOrigin derivation returns an origin, but the calling logic does not compare it against the URL used for the test request. This allows a URL from a different origin to flow through the credential test path unchallenged.

Attack Vector

Exploitation requires user interaction: an operator must be induced to complete the Instance AI credential setup flow while attacker-controlled content is in scope. Once the tainted URL reaches the verification step, the n8n backend performs an authenticated fetch or probe against the attacker-chosen origin. The request may follow redirects, expose credential material, or reach internal services otherwise unreachable from the internet. Confidentiality impact is high; integrity and availability are unaffected on the vulnerable component itself.

// No verified proof-of-concept code is published for CVE-2026-86074.
// See GHSA-q5wm-mgqx-fv2f for advisory details.

Detection Methods for CVE-2026-86074

Indicators of Compromise

Outbound HTTP requests from the n8n server to unexpected external hosts during credential setup or test operations.
Authenticated requests originating from n8n reaching internal-only IP ranges (RFC1918) or cloud metadata endpoints such as 169.254.169.254.
Log entries from @n8n/instance-ai credential utilities showing a verification URL whose origin does not match the associated workflow node.
Unexpected redirect chains initiated by the n8n backend during AI credential flows.

Detection Strategies

Inspect n8n application logs for credential test operations that reference URLs outside the declared service origin of the workflow node.
Instrument the reverse proxy or egress firewall to log all outbound requests from the n8n host and flag connections to non-approved destinations.
Correlate credential setup events with any anomalous outbound DNS resolutions performed by the n8n process.

Monitoring Recommendations

Enable egress filtering that restricts the n8n instance to a documented allowlist of third-party service origins.
Alert on any n8n-originated connections to link-local, loopback, or private IP ranges from a production deployment.
Retain and centrally aggregate n8n audit logs to enable retrospective review of credential setup activity following patch deployment.

How to Mitigate CVE-2026-86074

Immediate Actions Required

Upgrade n8n to version 2.37.7 or 2.38.2, depending on the deployment branch in use.
Audit recently created or modified Instance AI credentials for verification URLs pointing to unexpected origins.
Restrict outbound network access from the n8n host to only the third-party service origins required by active workflows.
Rotate any credentials that may have been tested through the vulnerable setup flow while attacker-influenced content was in scope.

Patch Information

The issue is fixed in n8n 2.37.7 and 2.38.2. Refer to the GitHub Security Advisory GHSA-q5wm-mgqx-fv2f, the n8n 2.37.7 release notes, and the n8n 2.38.2 release notes for upstream details.

Workarounds

Disable the Instance AI credential setup feature until the patched version is deployed.
Enforce network-level egress restrictions on the n8n host to block requests to unapproved origins, cloud metadata endpoints, and internal management networks.
Limit which operator accounts can create or modify Instance AI credentials until the upgrade is complete.

bash

# Upgrade example for Docker-based n8n deployments
docker pull n8nio/n8n:2.38.2
docker stop n8n && docker rm n8n
docker run -d --name n8n \
  -p 5678:5678 \
  -v n8n_data:/home/node/.n8n \
  n8nio/n8n:2.38.2