CVE-2026-77069

What it is

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-20 12:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-01 20:01 UTC Last updatedMost recent change to the record

Details

Published

2026-08-20 12:16 UTC

Last modified

2026-09-01 20:01 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-918 · Server-side request forgery

Record status

Analyzed

Affected

• n8n < 1.123.69
• n8n < 2.33.4
• n8n 2.34.0

Attack profile CVSS 4.0 · 2.3

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None