VULNERABILITY INTELLIGENCE

CVE-2026-65593

CVSS score5.4 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-07-22
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

Weakness classification

  • disclosure@vulncheck.com: CWE-918

Primary references