CVE Reports

Posted on Sep 10 Originally published at cvereports.com

CVE-2026-86082: CVE-2026-86082: Server-Side Request Forgery and Credential Leakage in n8n OpenAI Chat Model Node

#security #cve #cybersecurity

CVE-2026-86082: Server-Side Request Forgery and Credential Leakage in n8n OpenAI Chat Model Node

Vulnerability ID: CVE-2026-86082
CVSS Score: 7.1
Published: 2026-09-10

CVE-2026-86082 is a critical Server-Side Request Forgery (SSRF) and credential leakage vulnerability in n8n. The flaw exists in the OpenAI Chat Model node's searchModels function, which fails to enforce credential domain restrictions when populating the model dropdown list. This allows an authenticated workflow editor to exfiltrate plaintext OpenAI API keys to an arbitrary attacker-controlled domain by specifying a custom baseURL override.

TL;DR

An authenticated workflow editor can bypass credential domain restrictions in n8n's OpenAI Chat Model node, causing the backend to send plaintext OpenAI API keys to an arbitrary server during dynamic model search.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-918
Attack Vector: Network
CVSS Score: 7.1 (High)
Exploit Status: Proof of Concept (PoC) documented
CISA KEV Status: Not Listed
EPSS Score: 0.00246 (Percentile: 15.84%)
Impact: Plaintext Credential Leakage / Server-Side Request Forgery (SSRF)

Affected Systems

n8n
n8n-nodes-langchain
n8n: < 1.123.76 (Fixed in: 1.123.76)
n8n: >= 2.0.0, < 2.37.7 (Fixed in: 2.37.7)
n8n: >= 2.38.0, < 2.38.2 (Fixed in: 2.38.2)

Code Analysis

Commit: cbee391

Fix: Enforce domain restrictions in OpenAI model loader

Commit: 2a4ca78

Fix: Apply security assertions in OpenAI LMChat model search (2.37.7 backport)

Commit: 7bd63f4

Fix: Restrict custom baseURL for OpenAI model population in 2.38.2 release

Exploit Details

GitHub Security Advisory: Advisory documenting vulnerability mechanics, reproduction steps, and exploit details.

Mitigation Strategies

Upgrade n8n immediately to one of the patched releases: 1.123.76, 2.37.7, or 2.38.2.
Monitor egress connections from the n8n application containers to block unauthorized API endpoints.
Limit authorization for Workflow Editor roles to trusted organizational personnel.
Rotate all potentially exposed OpenAI API keys immediately.

Remediation Steps:

Identify all running instances of n8n and verify their current version numbers.
Apply the patch by deploying docker image tags n8n@1.123.76, n8n@2.37.7, or n8n@2.38.2.
Review n8n workspace settings and verify credentials configuration audit logs.
In the OpenAI developer dashboard, revoke and replace all keys mapped to active n8n instances.
Establish custom egress firewall policies restricting the n8n environment's outbound communication to verified domains.

References

Read the full report for CVE-2026-86082 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community