n8n-io n8n up to 2.34.0 Request Helper legacy request helper function uri/url server-side request forgery

Summaryinfo

A vulnerability labeled as critical has been found in n8n-io n8n up to 2.34.0. The impacted element is the function legacy request helper function of the component Request Helper. The manipulation of the argument uri/url results in server-side request forgery. This vulnerability is cataloged as CVE-2026-85172. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in n8n-io n8n up to 2.34.0. Affected is the function legacy request helper function of the component Request Helper. The manipulation of the argument uri/url with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-85172 since 09/03/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit.

Upgrading to version 2.34.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• n8n-io

Name

• n8n

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34.0

Website

• Product: https://github.com/n8n-io/n8n/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion