CVE-2026-77069 n8n before 1.123.69 SSRF Protection Bypass via OAuth2

Low 2.3 Published 20 Aug 2026 Updated 21 Aug 2026

An attacker with credential-creation permissions can bypass SSRF protections in n8n's OAuth2 token exchange to access internal network resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-77069?

CVE-2026-77069 is a low-severity server-side request forgery vulnerability in N8n N8n, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).

Weakness: CWE-918

Which versions are affected by CVE-2026-77069?

It affects 1 product.

Products include N8n N8n.

How do I fix CVE-2026-77069?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-77069 being exploited?

There is no known exploitation of CVE-2026-77069 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-4x7w-pwq5-598q, GHSA-c4f6-59xq-95ww, MINI-9r5q-5fwq-h2gq.