CVE-2026-65593 | n8n versions before 1.123.64 contain a server-side request f… | CVSS 6.3 MEDIUM

Description

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

Metadata

CVE ID: CVE-2026-65593
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-22 10:45 UTC
Published: 2026-07-22 11:21 UTC
Last updated: 2026-07-22 11:21 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: n8n-io / n8n
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

Affected products (3)

Vendor	Product	Platform	Versions
n8n-io	n8n	—	0 < 1.123.64, 1.123.64
n8n-io	n8n	—	0 < 2.30.1, 2.30.1
n8n-io	n8n	—	0 < 2.29.8, 2.29.8

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

References (2)

GitHub Security Advisory (GHSA-9w78-79q7-r4fp) https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp
VulnCheck Advisory: n8n before 1.123.64 SSRF via Dynamic Node Parameters https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters