CVE-2026-65593CWE-918

n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters

Medium · published July 22, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-22T11:21Z
EPSS history
Timeline
  • 22 JUL 11:21Z
    n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters
    cvelistv5