CVE-2026-77069: n8n before 1.123.69 SSRF Protection Bypass via OAuth2

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-09-01
Weakness: CWE-918

Description

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).

Affected products

n8n-io n8n: before 1.123.69; from 2.33.0 before 2.33.4; 2.34.0 — fixed in 1.123.69, 2.33.4

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.69, 2.33.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77069 or the next vulnerability affects your stack