CVE-2026-85172CWE-918ssrf

CVE-2026-85172

Medium · published September 3, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00261 · 17.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-03T17:06Z
Affected products (2)
ProductVersionsFixed in
n8n/n8n< 2.33.42.33.4
n8n/n8nall versions—
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj · [email protected]https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
    cvelistv5