Server-Side Request Forgery (SSRF) in n8n - #VU140989
Published: August 5, 2026
Vulnerability identifier: #VU140989
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose limited information from internal services.
The vulnerability exists due to improper access control in the OAuth2 credential token exchange flow when processing an authorization-code-to-access-token exchange request. A remote user can configure an access-token URL that points to an internal address and complete the OAuth2 flow to disclose limited information from internal services.
The reflected response is limited to targets that respond usefully to the fixed-shape token-exchange POST request, and the request method, headers, and body are constrained by the OAuth2 exchange fields.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.69, 2.33.4, 2.34.1