CVE-2026-85172: Server-Side Request Forgery (SSRF) in n8n-io n8n

CVE-2026-85172 is a server-side request forgery vulnerability affecting n8n versions before 2.34.1. The flaw exists in the legacy request helper function exposed to Code and Function nodes. The validation mechanism only inspects the 'uri' property for SSRF protections, while the HTTP client actually uses the 'url' property if both are present. This mismatch allows an attacker to bypass SSRF validation by supplying a benign 'uri' and a malicious 'url', which can be used to access internal network resources that should otherwise be protected.

An attacker with the ability to supply input to the affected request helper function can bypass SSRF validation controls and cause the server to make HTTP requests to internal or otherwise restricted network addresses. This can lead to unauthorized access to internal services or data exposure within the network environment where n8n is deployed. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low attack complexity, and limited privileges required.

A fix is available in n8n version 2.34.1 and later. Users should upgrade to version 2.34.1 or newer to remediate this vulnerability. Patch status is confirmed by the affectedVersions data indicating versions before 2.34.1 are vulnerable. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.