The vulnerability in n8n affects versions prior to 1.123.64 and involves SSRF via dynamic-node-parameters endpoints that lack proper authorization scopes. Authenticated users can exploit this by providing absolute URLs in routing configurations, bypassing baseURL restrictions and causing the server to issue HTTP requests to internal network resources if SSRF protections are disabled. This could allow attackers to access internal services not normally reachable from outside the server. The advisory is a duplicate and references GHSA-9w78-79q7-r4fp for the original report.

Authenticated attackers can exploit this SSRF vulnerability to make the n8n server send HTTP requests to arbitrary internal network targets, potentially accessing sensitive internal services or data. The impact depends on the internal network configuration and whether SSRF protections are enabled or disabled. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory GHSA-9w78-79q7-r4fp for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigations. Until a patch is applied, ensure SSRF protections are enabled and restrict authenticated user capabilities to prevent misuse of dynamic-node-parameters endpoints.