CVE-2026-65593 in n8n
Summary
by MITRE • 07/22/2026
n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical server-side request forgery flaw affecting n8n versions prior to 1.123.64, specifically within the dynamic-node-parameters endpoints where proper authorization scopes are missing. This weakness stems from insufficient validation of URL inputs in routing configurations, creating an avenue for malicious actors to manipulate the application's behavior by supplying absolute URLs that bypass normal baseURL restrictions. The flaw operates through the dynamic node parameter functionality which allows users to configure external API connections, but fails to properly sanitize or validate the URLs provided by authenticated users.
The technical implementation of this vulnerability allows attackers with valid authentication credentials to construct requests that can force the n8n server to make HTTP requests to arbitrary internal targets within the network infrastructure. When SSRF protection mechanisms are disabled or improperly configured, the application becomes susceptible to exploitation where attackers can leverage legitimate user sessions to access internal services that would normally be protected from external access. The vulnerability specifically targets the dynamic-node-parameters endpoints which are designed to fetch configuration data from external sources, but lack proper validation of the absolute URLs provided by users.
From an operational perspective, this vulnerability presents a significant risk to organizations using n8n as their workflow automation platform since authenticated attackers can potentially gain unauthorized access to internal systems, databases, or services that reside within the same network environment. The impact extends beyond simple data exfiltration as attackers could potentially exploit this weakness to perform further reconnaissance, escalate privileges, or launch additional attacks against internal targets. The vulnerability is particularly dangerous in environments where n8n servers have access to sensitive internal resources or where proper network segmentation has not been implemented.
The flaw aligns with CWE-918, which specifically addresses server-side request forgery vulnerabilities, and maps to ATT&CK technique T1071.004 for application layer protocol manipulation and T1566 for phishing with social engineering techniques. Organizations should implement immediate mitigations including upgrading to n8n version 1.123.64 or later, enforcing strict URL validation on all dynamic node parameters, implementing proper authorization scopes for endpoint access, and ensuring that SSRF protection mechanisms are enabled and properly configured. Additionally, network segmentation practices should be reviewed to limit the potential impact of successful exploitation, and monitoring should be enhanced to detect unusual patterns in outbound network requests from n8n servers.
The root cause of this vulnerability lies in the insufficient input validation and authorization checks within the dynamic node parameter handling logic. The application fails to properly validate that URLs provided by authenticated users are restricted to legitimate external targets while preventing access to internal network resources. This design flaw allows attackers to craft malicious requests that bypass normal security controls, effectively turning the n8n server into a potential proxy for accessing internal systems. The vulnerability demonstrates the critical importance of implementing proper input validation and authorization checks in web applications, particularly those handling user-supplied data that can influence network behavior.
Organizations should consider implementing additional defensive measures such as network-level restrictions on outbound connections from n8n servers, mandatory use of proxy configurations for external API calls, and regular security assessments of dynamic configuration parameters. The vulnerability also highlights the need for comprehensive security testing including penetration testing of workflow automation platforms to identify similar weaknesses in other components that may not be immediately obvious during standard development processes. Proper logging and monitoring of node parameter changes should be implemented to detect potential exploitation attempts and provide forensic capabilities for incident response activities.