CVE-2026-77069: Server-Side Request Forgery (SSRF) in n8n-io n8n

The vulnerability in n8n involves an SSRF protection bypass during the OAuth2 token exchange process. While most OAuth2-related requests use an SSRF-protected HTTP client, the token exchange uses a different client lacking SSRF safeguards. This allows a user with credential-creation permissions to specify an internal access-token URL, causing n8n to send a crafted POST request to that internal address and reflect the response body back to the attacker. The reflected data is limited to what the internal target returns for this specific request.

An attacker with credential-creation permissions can exploit this SSRF vulnerability to make n8n send POST requests to internal network addresses. The attacker can receive the response body from these internal requests, potentially exposing sensitive internal information. However, the reflected response is limited to the token-exchange POST request's output, and the vulnerability requires credential-creation permissions, limiting the attack scope. The CVSS score is low (2.3), indicating limited impact and exploitability.

The vulnerability is fixed in n8n versions 1.123.69, 2.33.4, and 2.34.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated or required beyond applying the official patches.