CVE-2026-77069
Received Received - Intake

SSRF Protection Bypass in n8n OAuth2 Token Exchange

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77069
EUVD
EUVD-2026-63258

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.69 (exc)
n8n n8n to 2.34.1 (exc)
n8n n8n to 2.33.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SSRF protection bypass in n8n versions before 1.123.69, 2.33.4, and 2.34.1. During OAuth2 credential authorization-code-to-access-token exchange, n8n uses a separate HTTP client without SSRF protection. An attacker with credential-creation permissions can set the access-token URL to an internal address, causing n8n to send a fixed POST request to that target and reflect its response back to the attacker.

Detection Guidance

Check n8n version with 'n8n --version' or 'docker exec <container> n8n --version'. If running versions before 1.123.69, 2.33.4, or 2.34.1, the system is vulnerable. Monitor network traffic for unexpected POST requests to internal addresses during OAuth2 token exchanges.

Impact Analysis

An attacker could probe internal systems and receive limited information based on the target's response. While the impact on confidentiality, integrity, and availability is limited, it could expose internal network details or sensitive data depending on the target's configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to internal systems through SSRF. An attacker might exfiltrate limited data from internal services, which could violate data protection requirements under these regulations if sensitive information is exposed.

Mitigation Strategies

Upgrade n8n to versions 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later. Restrict credential creation permissions to trusted users only. Block internal network egress from n8n instances to prevent SSRF attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77069. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart