n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

Published September 10, 2026 CVE-2026-86082

n8n could send an OpenAI credential to an unauthorized server through its OpenAI Chat Model node. This bypassed domain restrictions set by an administrator.

Severity
HighCVSS 4.0 · 7.1
Fix
Fixed in 1.123.76Fix recorded yesterday
Affected versions
2.38.0 or newer, but before 2.38.2; 2.0.0 or newer, but before 2.37.7; before 1.123.76
Weakness
CWE-918Server-Side Request Forgery (SSRF)
Exploit likelihood
0.25% in 30 daysEPSS, higher than 16% of known flaws
Affects
n8n

How it works

  • A workflow editor with access to the affected node could choose a different destination for model searches.
  • That search path did not check the credential's approved domains. n8n then sent the OpenAI credential to the chosen server.

What to do

Check your n8n installation version against the affected ranges in the security advisory. Also identify workflows using the OpenAI Chat Model node with domain-restricted OpenAI credentials.

Run this in the application environment you want to check:

npm ls --all n8n

Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, depending on your release branch, or a later version. Until then, restrict n8n access to fully trusted users, audit domain-restricted openAiApi credentials, and revoke use-only shares granted to untrusted users.

Technical details

CVE-2026-86082 is a server-side request forgery issue in n8n's OpenAI Chat Model node. The model-search path accepted an arbitrary destination without applying the credential's allowed-domain check, potentially exposing the credential there.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required Low Attacker needs a basic user account
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure Low Some data can be read
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source