CVE-2026-85172
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.
| CWE | CWE-918 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new unknown vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n8n-io / n8n
0 < 2.34.1
n8n-io / n8n
0 < 2.33.4
References
Credits
🔍 singetu0096