CVE-2026-86082: n8n Workflow Automation Platform SSRF Vulnerability

CVE-2026-86082 Overview

n8n is an open source workflow automation platform. CVE-2026-86082 is a server-side request forgery (SSRF) vulnerability [CWE-918] in the OpenAI Chat Model node. The node enforced credential allowed-domain restrictions for normal API calls but omitted the check on the model-search dropdown path. A workflow editor could set options.baseURL to an arbitrary host and cause searchModels to transmit the openAiApi credential to that host. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. The issue is fixed in versions 1.123.76, 2.37.7, and 2.38.2.

Critical Impact
An authenticated workflow editor can exfiltrate stored openAiApi credentials to an attacker-controlled host, bypassing configured allowed-domain restrictions.

Affected Products

n8n versions prior to 1.123.76
n8n versions prior to 2.37.7
n8n versions prior to 2.38.2

Discovery Timeline

2026-09-08 - CVE-2026-86082 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86082

Vulnerability Analysis

The vulnerability resides in the OpenAI Chat Model node shipped with n8n's LangChain integration. The node exposes two credential-consuming code paths: the normal chat completion path and the model-search dropdown that populates available models in the editor UI. The normal path invokes assertOpenAiCredentialAllowsUrl to verify the target baseURL matches the credential's configured allowed domains. The loadModels.ts helper responsible for the dropdown omitted this check entirely. As a result, any user with permission to edit a workflow can override options.baseURL to a host they control and trigger the dropdown load, which transmits the bound openAiApi credential in the request headers to the attacker's endpoint.

Root Cause

The root cause is missing input validation in packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts. The searchModels implementation did not call assertOpenAiCredentialAllowsUrl before dispatching the outbound request. Allowed-domain enforcement is a defense-in-depth control that constrains where stored credentials may be sent, and inconsistent enforcement across code paths defeats it.

Attack Vector

Exploitation requires an authenticated user with workflow editor privileges. The attacker adds or edits a workflow containing an OpenAI Chat Model node, binds a stored openAiApi credential, and sets options.baseURL to a controlled host such as https://attacker.example. Triggering the model-search dropdown causes the n8n server to issue an outbound HTTP request to that host with the credential's Authorization header attached. The attacker captures the token from server logs and reuses it against the real OpenAI API. See the GitHub Security Advisory GHSA-34ff-336r-5q23 for additional technical context.

Detection Methods for CVE-2026-86082

Indicators of Compromise

Outbound HTTP requests from n8n hosts to domains not present in configured openAiApi credential allowed-domain lists.
Requests to /v1/models or similar OpenAI-style model listing paths targeting non-OpenAI hosts.
Workflow revisions that set options.baseURL on OpenAI Chat Model nodes to unexpected or newly registered domains.

Detection Strategies

Review n8n audit logs for workflow edits that modify the baseURL field of LMChatOpenAi nodes.
Inspect egress proxy logs for requests originating from the n8n server that carry OpenAI-format bearer tokens to unapproved destinations.
Correlate workflow-editor user activity with outbound connections to low-reputation or newly observed hosts.

Monitoring Recommendations

Route all n8n outbound traffic through an egress proxy with allowlisting for known LLM provider domains.
Alert on new destination hosts contacted by the n8n service account.
Enable and retain n8n workflow versioning to reconstruct malicious edits during investigation.

How to Mitigate CVE-2026-86082

Immediate Actions Required

Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 depending on your release channel.
Rotate all openAiApi credentials stored in n8n that may have been exposed via editor access.
Audit workflow editor role assignments and remove users who do not require edit permissions.

Patch Information

The fix restores assertOpenAiCredentialAllowsUrl on the model-search code path. Patched releases are available at GitHub Release n8n@1.123.76, GitHub Release n8n@2.37.7, and GitHub Release n8n@2.38.2.

Workarounds

Restrict workflow editor permissions to trusted users until the patch is applied.
Enforce network-level egress filtering so the n8n server can only reach approved LLM provider endpoints.
Configure strict allowed-domain lists on openAiApi credentials and monitor for attempts to override baseURL in workflows.

bash

# Upgrade n8n via npm to a patched release
npm install -g n8n@1.123.76

# Or pull a patched Docker image
docker pull n8nio/n8n:2.38.2